Proxy GET Requests with IP-Embedded CVE-Related URL Parameters
Finds proxy GET URIs with risky extensions and a d=IPv4 parameter value in the query string.
FreeReviewedSigma · High · v5
- Category
- proxy
- Author
- X__Junior (SigmaHQ), DRL 1.1
- Published
- 2023-07-12
- Updated
- 2026-07-31
What it detects
This rule flags proxy traffic where a GET request URL matches a set of extensions (zip/asp/htm/url/xml/chm/mht/vbs/search-ms) followed by query parameters containing an IPv4 address. Such URL patterns can indicate automated probing or exploit delivery attempts that embed target IPs directly in the request. Detection relies on proxy logs containing the request method and full requested URI, specifically the URL path and query string pattern captured by the URL regex.
Reporting behind it
- blogs.blackberry.comhttps://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
detects-suspicious-proxy-get-requests-targeting-ip-parameters-in-url-query-strin-d9365e39
title: Proxy GET Requests with IP-Embedded CVE-Related URL Parameters
id: 5567955b-eeaf-4094-b7a4-4fee88024ea8
status: test
description: This rule flags proxy traffic where a GET request URL matches a set of extensions (zip/asp/htm/url/xml/chm/mht/vbs/search-ms) followed by query parameters containing an IPv4 address. Such URL patterns can indicate automated probing or exploit delivery attempts that embed target IPs directly in the request. Detection relies on proxy logs containing the request method and full requested URI, specifically the URL path and query string pattern captured by the URL regex.
references:
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
- attack.command-and-control
- cve.2023-36884
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
c-uri|re: \.(zip|asp|htm|url|xml|chm|mht|vbs|search-ms)\?d=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: d9365e39-febd-4a4b-8441-3ca91bb9d333
type: derived