Permalink
Switch branches/tags
Find file Copy path
6f20875 Dec 2, 2017
1 contributor

Users who have contributed to this file

17 lines (13 sloc) 291 Bytes
rule OfficeDDE1 {
strings:
$s1 = "w:instrText"
condition:
filename matches /word\/document.xml/ and $s1
}
rule OfficeDDE2 {
strings:
$s1 = "w:fldSimple"
$s2 = "w:instr"
condition:
filename matches /word\/document.xml/ and $s1 and $s2
}