HTTP GET Requests Containing /MSHTML_C7/ URL Marker (Proxy)

Alerts on proxy HTTP GET requests whose URI contains /MSHTML_C7/.

FreeUnreviewedSigmahighv1

http-get-requests-containing-mshtml-c7-url-marker-proxy-e59f71ff

title: HTTP GET Requests Containing /MSHTML_C7/ URL Marker (Proxy)
id: 7cc738dd-b0ff-4374-8833-dff5b2f50135
status: test
description: This rule flags proxy HTTP traffic where the request method is GET and the URL path contains the marker string /MSHTML_C7/. Attackers may use uncommon URL markers to route or trigger exploitation-related behavior, making this pattern useful for early investigation. It relies on proxy telemetry fields for HTTP method (cs-method) and the requested URI (c-uri).
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_url_marker_traffic.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
  - attack.command-and-control
  - cve.2023-36884
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|contains: /MSHTML_C7/
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e59f71ff-c042-4f7a-8a82-8f53beea817e
    type: derived

What it detects

This rule flags proxy HTTP traffic where the request method is GET and the URL path contains the marker string /MSHTML_C7/. Attackers may use uncommon URL markers to route or trigger exploitation-related behavior, making this pattern useful for early investigation. It relies on proxy telemetry fields for HTTP method (cs-method) and the requested URI (c-uri).

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.