HTTP GET Requests Containing /MSHTML_C7/ URL Marker (Proxy Logs)
Alerts on proxy HTTP GET requests whose URI contains /MSHTML_C7/.
FreeReviewedSigma · High · v5
- Category
- proxy
- Author
- X__Junior (SigmaHQ), DRL 1.1
- Published
- 2023-07-12
- Updated
- 2026-07-31
What it detects
This rule flags HTTP proxy traffic where the request method is GET and the requested URI contains the specific marker /MSHTML_C7/. Attackers often use consistent URL patterns as part of exploit delivery or follow-on command-and-control workflows, making this marker useful for identifying potential exploitation attempts. Detection relies on proxy telemetry capturing HTTP method and full request URI content.
Reporting behind it
- blogs.blackberry.comhttps://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_url_marker_traffic.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
http-get-requests-containing-mshtml-c7-url-marker-proxy-e59f71ff
title: HTTP GET Requests Containing /MSHTML_C7/ URL Marker (Proxy Logs)
id: 7cc738dd-b0ff-4374-8833-dff5b2f50135
status: test
description: This rule flags HTTP proxy traffic where the request method is GET and the requested URI contains the specific marker /MSHTML_C7/. Attackers often use consistent URL patterns as part of exploit delivery or follow-on command-and-control workflows, making this marker useful for identifying potential exploitation attempts. Detection relies on proxy telemetry capturing HTTP method and full request URI content.
references:
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_url_marker_traffic.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
- attack.command-and-control
- cve.2023-36884
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
c-uri|contains: /MSHTML_C7/
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: e59f71ff-c042-4f7a-8a82-8f53beea817e
type: derived