Rule Category

INDICATOR-OBFUSCATION -- Snort detected a system behavior that suggests the system has been affected by malware. That behavior is known as an Indicator of Compromise (IOC). The symptoms could be a wide range of behaviors, from a suspicious file name to an unusual use of a utility. Symptoms do not guarantee an infection; your network configuration may not be affected by malware, but showing indicators as a result of a normal function. This alert specifically refers to a method of disguising code, known as obfuscation. Obfuscation methods are used to perform innocent convenience tasks (for instance, Javascript used to condense Jquery scripts, or a compiler using obfuscation to protect the full code for NDA reasons), or it could be used to hide an attack.

Alert Message

INDICATOR-OBFUSCATION RTF file objdata hlsrc obfuscation attempt

Rule Explanation

This event is generated when an obfuscated RTF document is detected on the network. Impact: Attempted User Privilege Gain Details: This rule looks for an obfuscation technique that is used by adversaries in malicious RTF files to evade detection. Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

None

Rule Vulnerability

No information provided

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

None