79816564

Date: 2025-11-11 11:22:08
Score: 1.5
Natty:
Report link

You don't actually need PCRE to identify offices documents. For example, PDF can be identified using this simple rule:

rule pdf {
strings:
$pdf = "%PDF-"
condition:
$pdf at 0
}

For other documents, since they are actually packaged inside zip archives, you could search for the zip magic at offset 0, and search for the document type identifiable paths as strings in you yara

Reasons:
  • No code block (0.5):
  • Low reputation (1):
Posted by: Nova I Elithor