FILE-OFFICE Microsoft Office Equation Editor RTF evasion attempt

Stats

First seen: March 2022
Last seen: October 2026

Description

Detects an RTF document exploiting CVE-2018-0802 or CVE-2018-0798 through crafted embedded object declarations. The rule matches the component identifiers of Office scripting and shell objects that the exploit chains into after the initial equation corruption.

CVEs

CVE-2018-0802 CVE-2018-0798

Related malware families

CVE-2018-0802 CVE-2018-0798 Microsoft

Related blogs

New Formbook Campaign Delivered Through Phishing Emails

March 11, 20229 min read

References

portal.msrc.microsoft.com
portal.msrc.microsoft.com