Skip to content
Permalink
master
Switch branches/tags
Go to file
 
 
Cannot retrieve contributors at this time
9 lines (8 sloc) 233 Bytes
rule OleStream {
strings:
$ole_magic = { d0 cf 11 e0 a1 b1 1a e1 }
$ole_stream = "\x01Ole10Native" wide
condition:
filename matches /word\/embeddings\/*/ and
$ole_magic at 0 and $ole_stream
}