← Back to SOC feed Coverage →

potential CVE 2017 11882

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-06T11:00:00Z · Confidence: medium

Hunt Hypothesis

The detection rule identifies potential exploitation of CVE-2017-11882 by detecting suspicious behavior associated with the vulnerability, such as unusual process execution or network activity. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromise from adversaries leveraging this known vulnerability.

YARA Rule

rule potential_CVE_2017_11882
{
    meta:
      author = "ReversingLabs"
      reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
      
    strings:
        $docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }

        $equation1 = "Equation Native" wide ascii
        $equation2 = "Microsoft Equation 3.0" wide ascii

        $mshta = "mshta"
        $http  = "http://"
        $https = "https://"
        $cmd   = "cmd"
        $pwsh  = "powershell"
        $exe   = ".exe"

        $address = { 12 0C 43 00 }

    condition:
        $docfilemagic at 0 and any of ($mshta, $http, $https, $cmd, $pwsh, $exe) and any of ($equation1, $equation2) and $address
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 10 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/cve_rules/CVE-2017-11882.yar