Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. rule mwi_document : exploitdoc
  2. {
  3. meta:
  4. description = "MWI generated document"
  5.  
  6. strings:
  7. $field_creation_tag = "{\\field{\\*\\fldinst { INCLUDEPICTURE"
  8. $mwistat_url = ".php?id="
  9. $field_closing_tag = "\\\\* MERGEFORMAT \\\\d}}{\\fldrslt}}"
  10.  
  11. condition:
  12. all of them
  13. }