Volatility3 MCP Server

/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. */ rule rtf_objdata_urlmoniker_http { meta: ref = "https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/" strings: $header = "{\\rtf1" $objdata = "objdata 0105000002000000" nocase $urlmoniker = "E0C9EA79F9BACE118C8200AA004BA90B" nocase $http = "68007400740070003a002f002f00" nocase condition: $header at 0 and $objdata and $urlmoniker and $http }