Proxy Detection of GET Requests Targeting /MSHTML_C7/ with IP Parameter

title: Proxy Detection of GET Requests Targeting /MSHTML_C7/ with IP Parameter
id: 24d1ed29-6c4d-4161-9f53-b77d70a6b86c
status: test
description: This rule flags proxy web traffic where an HTTP GET request includes a URI containing /MSHTML_C7/ and a query parameter matching an IPv4-like pattern (four 1–3 digit octets). Such behavior can indicate exploitation-related probing or payload delivery attempts that embed target/network information in the request. Detection relies on proxy logs capturing HTTP method and requested URI, including the query string used to form the pattern match.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
  - attack.command-and-control
  - cve.2023-36884
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|contains: /MSHTML_C7/
    c-uri|re: \?d=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 0066d244-c277-4c3e-88ec-9e7b777cc8bc
    type: derived