mandiant/apooxml

Generate YARA rules for OOXML documents.

apooxml

Generate YARA rules for OOXML documents using ZIP local header metadata. To learn more about this tool and the methodology behind it, check out the accompanying blog here.

Usage

➜ python3 apooxml.py -h
usage: apooxml.py [-h] [-a AUTHOR] [-n NAME] [-o OUT] sample

Generate YARA rules for OOXML documents.

positional arguments:
  sample                OOXML document to generate YARA rule from.

optional arguments:
  -h, --help            show this help message and exit
  -a AUTHOR, --author AUTHOR
                        YARA rule author.
  -n NAME, --name NAME  YARA rule name.
  -o OUT, --out OUT     YARA rule file name.

apooxml's Issues

ValueError in month

Received an error
ValueError: month must be in 1..12

when executing against this sample
f019495a1d4feecc07769dc1fbecccb871634cc707c43befe1ea7aa2c629e337