SID 1:45466

Rule Category

FILE-OFFICE -- Snort detected traffic targeting vulnerabilities in files belonging to the Microsoft Office suite of software (Excel, PowerPoint, Word, Visio, Access, Outlook, etc.).

Alert Message

FILE-OFFICE Microsoft Office None type objclass RTF evasion attempt

Rule Explanation

This event is generated when an RTF is detected with an embedded class declared as "None". This could indicate an attempt to evade security products. Impact: Attempted User Privilege Gain Details: Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group