Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments

Hunt Hypothesis

This hunt targets adversaries leveraging Rich Text Format (RTF) email attachments that trigger the download of external resources, a technique often used to establish initial footholds or exfiltrate data without direct file execution. Proactively hunting for this pattern in Azure Sentinel is critical because such behavior frequently indicates early-stage phishing campaigns designed to bypass traditional signature-based defenses by exploiting legitimate system processes during resource retrieval.

YARA Rule

rule SUSP_Doc_RTF_OLE2Link_EMAIL_Jun22 {
   meta:
      description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
      author = "Christian Burkard"
      date = "2022-06-01"
      reference = "Internal Research"
      hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
      score = 75
      id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"
   strings:
      /* \objdata" */
      $sa1 = "XG9iamRhdG" ascii
      $sa2 = "xvYmpkYXRh" ascii
      $sa3 = "cb2JqZGF0Y" ascii

      /* OLE2Link */
      $sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
      $sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
      $sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
      $sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
      $sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
      $sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii

      /* docfile magic - doc file albilae */
      $sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
      $sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
      $sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
      $sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
      $sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
      $sc6 = "EMENGMTFFMEExQjExQUUx" ascii

      /* http:// */
      $x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
      $x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
      $x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
      $x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
      $x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
      $x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
      /* https:// */
      $x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
      $x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
      $x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
      $x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
      $x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
      $x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
      /* ftp:// */
      $x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
      $x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
      $x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
      $x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
      $x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
      $x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
      /* TODO: more protocols */
   condition:
      filesize < 10MB
      and 1 of ($sa*)
      and 1 of ($sb*)
      and 1 of ($sc*)
      and 1 of ($x*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 33 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments”, including suggested filters and exclusions:

• Scenario: Automated Report Distribution via Microsoft Power BI

  • Context: The enterprise uses Power BI to automatically generate daily executive dashboards. These reports are exported as .rtf documents containing embedded charts that reference high-resolution images hosted on the internal Azure Blob Storage or SharePoint CDN. When these emails are opened by recipients, the RTF renderer fetches these external assets.
  • Suggested Filter/Exclusion: Create a whitelist for the specific URL domain hosting the report assets (e.g., *.sharepoint.com or *.azurewebsites.net). Additionally, exclude traffic originating from the internal Power BI Service account (PowerBI-Service) where the destination IP falls within the corporate intranet range.

• Scenario: Legal Document Review using Adobe Acrobat Pro

  • Context: The Legal Department utilizes a workflow where contract drafts are converted to RTF for review. These documents often include dynamic logos, watermarks, and signature stamps stored on an internal Document Management System (DMS) like SharePoint or NetDocuments. When attorneys open these attachments in Outlook with Adobe Acrobat Pro as the default viewer, the application triggers HTTP requests to fetch these resources.
  • Suggested Filter/Exclusion: Implement a rule exclusion based on the file hash of known “safe” RTF templates used by Legal. Alternatively, filter out events where the external resource URL matches the internal DMS prefix (e.g., https://dms.internal.corp.com/assets/*) and the user group is Legal-Reviewers.

• Scenario: Scheduled HR Onboarding Packets

  • Context: The HR team runs a scheduled nightly job using Microsoft Flow (Power Automate) to send