Remote Office Template Injection via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to inject remote office templates via HTTP. It specifically looks for HTTP traffic flowing to the client that contains both 'attachedTemplate' and 'http' (case-insensitive) in the file data, indicating a potential attempt to load a remote template.