Commit 5510462d by mmorenog

Update malicious_document.yar

parent 92c38c68
......@@ -216,7 +216,7 @@ rule office_document_vba
($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))
}
ule Office_AutoOpen_Macro {
rule Office_AutoOpen_Macro {
meta:
description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
author = "Florian Roth"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment