Detects Suspicious Proxy GET Requests Targeting IP Parameters in URL Query Strings

title: Detects Suspicious Proxy GET Requests Targeting IP Parameters in URL Query Strings
id: 5567955b-eeaf-4094-b7a4-4fee88024ea8
status: test
description: This rule matches proxy traffic where a GET request URI contains a file extension (zip|asp|htm|url|xml|chm|mht|vbs|search-ms) followed by a query parameter of the form d=x.x.x.x. Such URL patterns can indicate crafted requests used to redirect payload delivery or command/control behavior based on an IP address value in the URL. It relies on proxy logs that record the HTTP method and the full requested URI, including query strings.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
  - attack.command-and-control
  - cve.2023-36884
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|re: \.(zip|asp|htm|url|xml|chm|mht|vbs|search-ms)\?d=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d9365e39-febd-4a4b-8441-3ca91bb9d333
    type: derived