Word_Document_with_Suspicious_Metadata

YARA detection rule by InQuest Labs · GPL-2.0

This signature detects suspicious metadata within a Microsoft Word document. Document properties, also known as metadata, are details about a file that describe or identify it. Document properties include details such as title, author name, operator, subject, and keywords that identify the document's topic or contents.

rule Word_Document_with_Suspicious_Metadata {
  meta:
    author         = "InQuest Labs"
    description    = "This signature detects suspicious metadata within a Microsoft Word document. Document properties, also known as metadata, are details about a file that describe or identify it. Document properties include details such as title, author name, operator, subject, and keywords that identify the document's topic or contents."
    created_date   = "2022-03-15"
    updated_date   = "2022-03-15"
    blog_reference = "https://www.schneier.com/blog/archives/2005/11/metadata_in_ms.html"
    labs_reference = "https://labs.inquest.net/dfi/sha256/db0037a9753c364022af4bb7d578996b78ccc3c28b01c6632ccd95a69d49d67c"
    labs_pivot     = "https://labs.inquest.net/dfi/search/alert/Suspicious%20XMP%20Identifier"
    samples        = "db0037a9753c364022af4bb7d578996b78ccc3c28b01c6632ccd95a69d49d67c"

  strings:
    $rtf1  = /^\x7b\x5c\x72\x74/  
    $rtf2  = "Microsoft Office Word"
    $a0    = { 07 74 6E 61 75 74 68 6F 72 20 4A 6F 68 6E 20 44 6F 65 7D }
    $a1    = "Vjkygdjdtyuj" nocase
    $a2    = "{\\*\\company \\'ce\\'a2\\'c8\\'ed\\'d6\\'d0\\'b9\\'fa"
    $a3    = "{\\author author000}"
    $a4    = "{\\operator author000}"
    $a5    = "{\\*\\company google}"
    $a7    = "Tran Duy Linh"
    $a8    = "DLC Corporation"
    $a9    = "{\\author testhome}"
    $a10   = "{\\operator testhome}"
    $a11   = "{\\author Nkosi Moyo"
    $a12   = "{\\operator Victor Ignatiev"
    $a13   = "{\\*\\company ECOBANK}"
    $a14   = "{\\title Your Company Name}"
    $a15   = "{\\author Geoffrey Draper}"
    $a16   = "{\\*\\company Le Grand Marketing}"
    $a17   = "{\\author kirichek"
    $a18   = "{\\title \\'c1\\'cb\\'c0\\'cd\\'ca \\'c7\\'c0\\'ca\\'c0\\'c7\\'c0}"
    $a19   = "{\\operator admin}"
    $a20   = "{\\author joy}"
    $a21   = "{\\operator PMALO}"
    $a23   = "{\\operator test}"
    $a24   = "{\\author Stone"
    $a25   = "{\\operator Stone"
    $a26   = "{\\title A* }"
    $a27   = "{\\author xxxxxxxxx}"
    $a28   = "{\\operator xxxxxxxxx}"
    $a29   = "{\\author xxx}"
    $a30   = "{\\operator xxx}"
    $a31   = "{\\*\\company 1stconsult}"
    $a32   = "{\\author user}"
    $a33   = "{\\operator user}"
    $a34   = "{\\*\\company ooo}"
    $a35   = "{\\author \\'cf\\'e0\\'e2\\'e5\\'eb}"
    $a36   = "{\\operator 1}"
    $a37   = "{\\author blursight}"
    $a38   = "{\\operator blursight}"
    $a39   = "{\\author MC SYSTEM}"
    $a40   = "{\\operator MC SYSTEM}"
    $a41   = "{\\*\\company MC SYSTEM}"
    $a42   = "{\\author Work}"
    $a43   = "{\\operator JSman}"
    $a44   = "{\\*\\company Grizli777}"
    $a45   = "{\\author wingdbg}"
    $a46   = "{\\operator wingdbg}"
    $a47   = "{\\author Dmk}"
    $a48   = "{\\operator Dmk}"
    $a49   = "{\\author TSEEDUP}"
    $a50   = "{\\author conqueror}"
    $a51   = "{\\operator conqueror}"
    $mil1  = "\\0CF11E0A1B11AE10000000"
    $mil2  = "\\author abc}{\\operator abc"
    $mil3  = "{\\info{\\title  }{\\author admin"
    $mil4  = "title AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA}{\\author bbk}"
    $mil5  = "{\\author Microsoft"
    $mil6  = "{\\creatim\\yr2010\\mo11\\dy29\\hr16\\min35}"
    $mil7  = "author xp"
    $mil10 = "D0CF11E0A1B11AE"
    $mil11 = "\\info{itle Template}{uthor John Doe}}"
    $mil12 = "\\title aaa"
    $mil13 = "tnauthor leeyth"

  condition:
    1 of ($rtf*) and any of ($a*, $mil*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0eeca81a-c9b3-4289-b0b6-0b21e089cdcb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion