Word_Document_with_Suspicious_Metadata.yar

rule Word_Document_with_Suspicious_Metadata
{
    meta:
        author         = "InQuest Labs"
        description    = "This signature detects suspicious metadata within a Microsoft Word document. Document properties, also known as metadata, are details about a file that describe or identify it. Document properties include details such as title, author name, operator, subject, and keywords that identify the document's topic or contents."
        created_date   = "2022-03-15"
        updated_date   = "2022-03-15"
        blog_reference = "https://www.schneier.com/blog/archives/2005/11/metadata_in_ms.html"
        labs_reference = "https://labs.inquest.net/dfi/sha256/db0037a9753c364022af4bb7d578996b78ccc3c28b01c6632ccd95a69d49d67c"
        labs_pivot     = "https://labs.inquest.net/dfi/search/alert/Suspicious%20XMP%20Identifier"
        samples        = "db0037a9753c364022af4bb7d578996b78ccc3c28b01c6632ccd95a69d49d67c"

	strings:
			$rtf1 = /^\x7b\x5c\x72\x74/   /* {\\rt */
		$rtf2 = "Microsoft Office Word"
		$a0 = { 07 74 6E 61 75 74 68 6F 72 20 4A 6F 68 6E 20 44 6F 65 7D }
		$a1 = "Vjkygdjdtyuj" nocase
		$a2 = "{\\*\\company \\'ce\\'a2\\'c8\\'ed\\'d6\\'d0\\'b9\\'fa"
		$a3 = "{\\author author000}"
		$a4 = "{\\operator author000}"
		$a5 = "{\\*\\company google}"
		$a7 = "Tran Duy Linh"
		$a8 = "DLC Corporation"
		$a9 = "{\\author testhome}"
		$a10 = "{\\operator testhome}"
		$a11 = "{\\author Nkosi Moyo"
		$a12 = "{\\operator Victor Ignatiev"
		$a13 = "{\\*\\company ECOBANK}"
		$a14 = "{\\title Your Company Name}"
		$a15 = "{\\author Geoffrey Draper}"
		$a16 = "{\\*\\company Le Grand Marketing}"
		$a17 = "{\\author kirichek"
		$a18 = "{\\title \\'c1\\'cb\\'c0\\'cd\\'ca \\'c7\\'c0\\'ca\\'c0\\'c7\\'c0}"
		$a19 = "{\\operator admin}"
		$a20 = "{\\author joy}"
		$a21 = "{\\operator PMALO}"
		$a23 = "{\\operator test}"
		$a24 = "{\\author Stone"
		$a25 = "{\\operator Stone"
		$a26 = "{\\title A* }"
		$a27 = "{\\author xxxxxxxxx}"
		$a28 = "{\\operator xxxxxxxxx}"
		$a29 = "{\\author xxx}"
		$a30 = "{\\operator xxx}"
		$a31 = "{\\*\\company 1stconsult}"
		$a32 = "{\\author user}"
		$a33 = "{\\operator user}"
		$a34 = "{\\*\\company ooo}"
		$a35 = "{\\author \\'cf\\'e0\\'e2\\'e5\\'eb}"
		$a36 = "{\\operator 1}"
		$a37 = "{\\author blursight}"
		$a38 = "{\\operator blursight}"
		$a39 = "{\\author MC SYSTEM}"
		$a40 = "{\\operator MC SYSTEM}"
		$a41 = "{\\*\\company MC SYSTEM}"
		$a42 = "{\\author Work}"
		$a43 = "{\\operator JSman}"
		$a44 = "{\\*\\company Grizli777}"
		$a45 = "{\\author wingdbg}"
		$a46 = "{\\operator wingdbg}"
		$a47 = "{\\author Dmk}"
		$a48 = "{\\operator Dmk}"
		$a49 = "{\\author TSEEDUP}"
		$a50 = "{\\author conqueror}"
		$a51 = "{\\operator conqueror}"
		$mil1 = "\\0CF11E0A1B11AE10000000"
		$mil2 = "\\author abc}{\\operator abc"
		$mil3 = "{\\info{\\title  }{\\author admin"
		$mil4 = "title AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA}{\\author bbk}"
		$mil5 = "{\\author Microsoft"
		$mil6 = "{\\creatim\\yr2010\\mo11\\dy29\\hr16\\min35}"
		$mil7 = "author xp"
		$mil10 = "D0CF11E0A1B11AE"
		$mil11 = "\\info{itle Template}{uthor John Doe}}"
		$mil12 = "\\title aaa"
		$mil13 = "tnauthor leeyth"
	condition:
			1 of ($rtf*) and any of ($a*,$mil*)
}