DDE Formula Injection in Office File Download

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the download of a file over HTTP that contains the string "=cmd|" (case-insensitive) within its data. This pattern is indicative of a DDE (Dynamic Data Exchange) formula injection attempt, often used in Office documents to execute commands.