Proxy GET Requests with IP-Embedded CVE-Related URL Parameters

Finds proxy GET URIs with risky extensions and a d=IPv4 parameter value in the query string.

FreeReviewedSigma · High · v5
Category
proxy
Author
X__Junior (SigmaHQ), DRL 1.1
Published
2023-07-12
Updated
2026-07-31
title: Proxy GET Requests with IP-Embedded CVE-Related URL Parameters
id: 5567955b-eeaf-4094-b7a4-4fee88024ea8
status: test
description: This rule flags proxy traffic where a GET request URL matches a set of extensions (zip/asp/htm/url/xml/chm/mht/vbs/search-ms) followed by query parameters containing an IPv4 address. Such URL patterns can indicate automated probing or exploit delivery attempts that embed target IPs directly in the request. Detection relies on proxy logs containing the request method and full requested URI, specifically the URL path and query string pattern captured by the URL regex.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
  - attack.command-and-control
  - cve.2023-36884
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|re: \.(zip|asp|htm|url|xml|chm|mht|vbs|search-ms)\?d=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d9365e39-febd-4a4b-8441-3ca91bb9d333
    type: derived