// MakeNotWork - VBA auto-exec macro droppers.
// Office documents that auto-run a macro which shells out or pulls a payload.
// The auto-exec entrypoint alone is common in benign templates, so it must
// co-occur with an execution/download primitive to fire. Untrusted uploads are
// held regardless; this flags the obvious macro-dropper shape in-process.

rule office_macro_autoexec_dropper {
    meta:
        description = "VBA auto-exec macro paired with shell/download primitives"
    strings:
        $auto1 = "AutoOpen" ascii nocase
        $auto2 = "Document_Open" ascii nocase
        $auto3 = "Auto_Open" ascii nocase
        $auto4 = "Workbook_Open" ascii nocase
        $exec1 = "WScript.Shell" ascii nocase
        $exec2 = "Shell(" ascii nocase
        $exec3 = "CreateObject" ascii nocase
        $exec4 = "URLDownloadToFile" ascii nocase
        $exec5 = "MSXML2.XMLHTTP" ascii nocase
    condition:
        (1 of ($auto*)) and (2 of ($exec*))
}