Yara rule - xlsb_with_xlm_macro

rule xlsb_with_xlm_macro{
    meta:
        description = "Detects Modern Excel4 macro use"
        author = "DissectMalware"
    strings:
        $zip_marker = "PK"
        $xlsx_marker = {5B 43 6F 6E 74 65 6E 74 5F 54 79 70 65 73 5D 2E 78 6D 6C}
        $macrosheet_marker = {77 6F 72 6B 62 6F 6F 6B 2E 62 69 6E}
    condition:
        $zip_marker at 0 and $xlsx_marker and $macrosheet_marker
}