Update expl_outlook_cve_2024_21413.yar

Neo23x0 · Feb 19, 2024 · a6855e2 · a6855e2
1 parent 995df52
commit a6855e2
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/yara/expl_outlook_cve_2024_21413.yar b/yara/expl_outlook_cve_2024_21413.yar
@@ -5,12 +5,13 @@ rule EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 {
       author = "Florian Roth"
       reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
       date = "2024-02-17"
+      modified = "2024-02-19"
       score = 75
    strings:
       $a1 = "Subject: "
       $a2 = "Received: "
 
-      $xr1 = /href[\s=3D"']{2,20}file:\/\/\/\\\\[^"']{6,200}!/
+      $xr1 = /(href|src)[\s=3D"']{2,20}file:\/\/\/\\\\[^"']{6,200}!/
    condition:
       filesize < 800KB
       and all of ($a*)