Detects a suspicious pattern in RTF files which downloads external resources

Hunt Hypothesis

This detection identifies adversaries leveraging Rich Text Format (RTF) documents to silently download and execute external resources, a common tactic used to establish persistence or exfiltrate data without triggering standard file-type alerts. Proactive hunting for this behavior in Azure Sentinel is critical because RTF files often bypass traditional email gateway scans, allowing attackers to bridge the gap between initial user interaction and subsequent lateral movement within the network.

YARA Rule

rule SUSP_Doc_RTF_OLE2Link_Jun22 {
   meta:
      description = "Detects a suspicious pattern in RTF files which downloads external resources"
      author = "Christian Burkard"
      date = "2022-06-01"
      reference = "Internal Research"
      hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
      score = 75
      id = "e9c83d58-6214-51d5-882a-4bd2ed6acc9a"
   strings:
      $sa = "\\objdata" ascii nocase

      $sb1 = "4f4c45324c696e6b" ascii /* OLE2Link */
      $sb2 = "4F4C45324C696E6B" ascii

      $sc1 = "d0cf11e0a1b11ae1" ascii /* docfile magic - doc file albilae */
      $sc2 = "D0CF11E0A1B11AE1" ascii

      $x1 = "68007400740070003a002f002f00" ascii /* http:// */
      $x2 = "68007400740070003A002F002F00" ascii
      $x3 = "680074007400700073003a002f002f00" ascii /* https:// */
      $x4 = "680074007400700073003A002F002F00" ascii
      $x5 = "6600740070003a002f002f00" ascii /* ftp:// */
      $x6 = "6600740070003A002F002F00" ascii
      /* TODO: more protocols */
   condition:
      ( uint32be(0) == 0x7B5C7274 or uint32be(0) == 0x7B5C2A5C ) /* RTF */
      and $sa
      and 1 of ($sb*)
      and 1 of ($sc*)
      and 1 of ($x*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

False Positive Scenarios for “Suspicious Pattern in RTF Files Downloading External Resources”

• Scenario: Microsoft Office 365 Auto-Update and Template Refresh

  • Context: When users open RTF documents created by the organization’s centralized template library, Microsoft Word (via Office 365) automatically fetches updated header/footer images or font assets from the internal Azure CDN to ensure brand consistency. This external resource download triggers the rule even though the source is trusted and expected.
  • Filter/Exclusion: Exclude traffic where the destination domain matches the organization’s specific Azure CDN subdomain (e.g., *.assets.office365.com or a custom internal URL) and the user agent string contains Microsoft Office.

• Scenario: Automated Compliance Reporting via Scheduled PowerShell Jobs

  • Context: A nightly scheduled task (Task Scheduler) runs a PowerShell script that generates compliance audit reports in RTF format. The script includes embedded charts pulled from an external analytics dashboard (e.g., Tableau Server or Power BI Embedded) hosted on a public IP, causing the rule to flag the resource download as suspicious during off-hours.
  • Filter/Exclusion: Create an exclusion for processes named powershell.exe running under the specific service account used for reporting (e.g., svc-compliance-reports) and restrict the trigger time window to exclude business hours if the job runs strictly at 02:00 AM.

• Scenario: Legacy Document Viewer Rendering in Web Browsers

  • Context: Employees using legacy internal portals (e.g., built on SharePoint or custom .NET apps) view RTF documents directly within a browser (Chrome/Edge). The browser’s rendering engine downloads external CSS stylesheets and icons referenced in the RTF file from the organization’s public-facing web server to render the document correctly.

  ---