Permalink
Switch branches/tags
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
10 lines (8 sloc) 233 Bytes
rule OleStream {
strings:
$ole_magic = { d0 cf 11 e0 a1 b1 1a e1 }
$ole_stream = "\x01Ole10Native" wide
condition:
filename matches /word\/embeddings\/*/ and
$ole_magic at 0 and $ole_stream
}