Skip to content
Permalink
master
Switch branches/tags
Go to file
 
 
Cannot retrieve contributors at this time
16 lines (13 sloc) 291 Bytes
rule OfficeDDE1 {
strings:
$s1 = "w:instrText"
condition:
filename matches /word\/document.xml/ and $s1
}
rule OfficeDDE2 {
strings:
$s1 = "w:fldSimple"
$s2 = "w:instr"
condition:
filename matches /word\/document.xml/ and $s1 and $s2
}