attachment_smb_remote_template_injection.yml

name: "Attachment: Microsoft Word SMB-hosted Remote Template Injection"
description: |
  A Microsoft Word document, or zipped document, that makes use of remote template injection where the template is accessed via SMB.
type: "rule"
severity: "high"
authors:
  - twitter: "delivr_to"
references:
  - https://delivr.to/payloads?id=73895e1a-4c15-4d1e-8e17-60f05baafdd2
source: |
  type.inbound
  and any(attachments,
      (
          (
              // ms word files
              .file_extension in~ ("doc", "docx", "docm", "dot", "dotm", "wbk")
              or .file_extension in~ $file_extensions_common_archives
              or (
                  .file_extension is null
                  and .file_type == "unknown"
                  and .content_type == "application/octet-stream"
                  and .size < 100000000
              )
          )
          and any(file.explode(.),
              .flavors.mime == "text/xml"
              and .file_name == "word/_rels/settings.xml.rels"
              and any(.scan.strings.strings,
                  regex.icontains(., 'Target.{0,20}\\\\.+\..+\.dotm')
              )
          )
      )
  )

tags:
  - "Suspicious Attachment"