Yara Rule to Detect Ursnif

/*
   Yara Rule Set
   Author: Ruben Dodge - www.dodgethissecurity.com
   Date: 2017-07-13
   Identifier:
*/

/* Rule Set ----------------------------------------------------------------- */

rule PossibleUrsnifEncryptedWordDocument {
   meta:
      description = "Rule created to detect Ursnif Word Documents while still in their encrypted state."
      author = "Ruben Dodge"
      reference = "not set"
      date = "2017-07-13"
      rev = 1
      weight = 100
   strings:
      $x1 = "<dataIntegrity encryptedHmacKey=" ascii /* Document Encryption Check 1 */
      $x2 = "<encryption xmlns=\"http://schemas.microsoft.com/office/2006/encryption\" xmlns:p=\"http://schemas.microsoft.com/office/2006/key" ascii /* Document Encryption Check 2 */
      $s3 = "Microsoft.Container.EncryptionTransform" fullword wide /* Document Encryption Check 3 */
      $s4 = "EncryptedPackage2" fullword wide /* Document Encryption Check 4 */
      $s5 = "StrongEncryptionDataSpace" fullword wide /* Document Encryption Check 5 */
      $s6 = "{FF9A3F03-56EF-4613-BDD5-5A41C1D07246}N" fullword wide /* Unknown ID used in each of the encrypted documents, most likely it corresponds to a unique identifier for encryption settings */
      $s7 = "cipherAlgorithm=\"AES" fullword ascii /* Check for AES encryption as the chosen encryption algorithm */
      $s8 = "hashAlgorithm=\"SHA512" fullword ascii /* Check for SHA512 hashing algorithm as the chosen algorithm, this is not the default hashing algorithm choice. */
      $s9 = "keyBits=\"256" fullword ascii /* Key bits, it should be noted this is not the default setting for encryption 128 is the default. */
      $s10 = "cipherChaining=\"ChainingModeCBC" fullword ascii /* Cipher Chaining Algorithm */
      $s11 = "<keyData saltSize=\"16" fullword ascii /* Document Encryption Check 6 */
      $s12 = "blockSize=\"16" fullword ascii /* Document Encryption Check 7 */
      $s13 = "hashSize=\"64" fullword ascii /* Document Encryption Check 8 */
	  $s14 = "DocumentSummaryInformation" fullword wide /* Check for the existence of the purposely filled out Document metadata. */
	  $s15 = "<p:encryptedKey spinCount=\"100000" fullword ascii /* The Encryption key spin count used to make decryption more difficult of AES encrypted data. This is a default setting. */
	  $s16 = "SummaryInformation" fullword wide /* Second check for purposely filled out metadata. */
   condition:
      ( uint16(0) == 0xcfd0 and ( all of ($x*) and all of ($s*) ) ) and ( filesize < 200KB )
}