RTF_Objupdate

YARA detection rule by InQuest Labs · GPL-2.0

This signature detects RTF files with an 'objupdate' directive. While not guaranteed to be malicious this signature has proven effective for threat hunting in the field.

rule RTF_Objupdate {
  meta:
    author         = "InQuest Labs"
    description    = "This signature detects RTF files with an 'objupdate' directive. While not guaranteed to be malicious this signature has proven effective for threat hunting in the field."
    created_date   = "2022-03-15"
    updated_date   = "2022-03-15"
    blog_reference = "http://www.biblioscape.com/rtf15_spec.htm"
    labs_reference = "N/A"
    labs_pivot     = "N/A"
    samples        = "eaaefa41eaaeac943dede195f3a00b1e424d152cf08243d023009fafdfa6c52b"

  strings:
    $magic1 = { 7b 5c 72 74 (7B | 66) }      $upd    = "\\objupdate" nocase

  condition:
    $magic1 in (0..30) and $upd and filesize > 50KB and filesize < 500KB

}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

66c7c671-3975-47e1-9ef8-588c8dc127b1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion