Update third-party rules as of 2025-12-16 (#1272)

Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>

Author: octo-sts[bot]

third_party/yara/bartblaze/APT/RoyalRoad_RTF.yar

@@ -11,7 +11,7 @@ rule RoyalRoad_RTF
         sharing = "TLP:CLEAR"
         source = "BARTBLAZE"
         author = "@bartblaze"
-        description = "Identifies RoyalRoad RTF, used by multiple China-based APT groups."
+        description = "Identifies RoyalRoad RTF, used by multiple China-nexus APT groups."
         category = "MALWARE"
         malware = "ROYALROAD"        
         malware_type = "EXPLOITKIT"

third_party/yara/bartblaze/RELEASE

@@ -1 +1 @@
-9f699cd0b0949da4f4991547514dbeaf1c432114
+12ad80662dba724a39f9ad8d5fad005a8be7ba54

third_party/yara/bartblaze/generic/GrimResource.yar

@@ -0,0 +1,29 @@
+rule GrimResource
+{
+    meta:
+        id = "6AllkuLIfG9lO9ZRaxm6Ni"
+        fingerprint = "v1_sha256_9d266207dd5688a68a837d9d764aa7390183a8b551b0524e6d21f80a34afeb29"
+        version = "1.0"
+        date = "2025-12-15"
+        modified = "2025-12-15"
+        status = "RELEASED"
+        sharing = "TLP:CLEAR"
+        source = "BARTBLAZE"
+        author = "@bartblaze"
+        description = "Identifies GrimResource and potential derivatives or variants."
+        category = "INFO"
+        reference = "https://www.elastic.co/security-labs/grimresource"
+
+    strings:
+        $xml = "<?xml"
+
+        $grim_a = "MMC_ConsoleFile"
+        $grim_b = ".loadXML("
+
+        $other_a = "ActiveXObject"
+        $other_b = "ms:script"
+        $other_c = "CDATA"
+
+    condition:
+        $xml at 0 and (all of ($grim_*) or all of ($other_*))
+}