FILE-OFFICE Microsoft Office Equation Editor RTF embedded OLE evasion attempt

IPS-CFWIPS-SWG

1 SID: 50684

Stats

First seen: February 2022
Last seen: October 2026

Description

Detects an RTF document whose equation object class hides an embedded OLE compound document, the delivery pattern for CVE-2017-11882 and CVE-2018-0802 exploits. The rule matches the equation class declaration followed by an embedded document payload.

CVEs

CVE-2017-11882 CVE-2018-0802

Related malware families

CVE-2017-11882 Exploit Overlay CVE-2018-0802 Microsoft

Related blogs

New Formbook Campaign Delivered Through Phishing Emails

New Formbook Campaign Delivered Through Phishing Emails

March 11, 20229 min read

TelegramRAT evades traditional defenses via the cloud

TelegramRAT evades traditional defenses via the cloud

December 18, 20177 min read

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

December 14, 20175 min read

References