Proxy HTTP GET Pattern Matching /MSHTML_C7/ with IPv4 Query Parameters
Alerts on proxy HTTP GET requests to /MSHTML_C7/ with an IPv4-like query parameter pattern.
FreeReviewedSigma · Critical · v5
- Category
- proxy
- Author
- X__Junior (SigmaHQ), DRL 1.1
- Published
- 2023-07-12
- Updated
- 2026-07-31
What it detects
This rule flags proxy traffic where an HTTP GET request targets a URI containing /MSHTML_C7/ and includes a query string formatted like four dot-separated IPv4 octets. Such highly specific URI patterns can indicate attempted exploitation workflows that rely on malformed or targeted request parameters. Detection relies on proxy logs capturing the HTTP method and the full requested URI, including query strings.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-detection-of-get-requests-targeting-mshtml-c7-with-ip-parameter-0066d244
title: Proxy HTTP GET Pattern Matching /MSHTML_C7/ with IPv4 Query Parameters
id: 24d1ed29-6c4d-4161-9f53-b77d70a6b86c
status: test
description: This rule flags proxy traffic where an HTTP GET request targets a URI containing /MSHTML_C7/ and includes a query string formatted like four dot-separated IPv4 octets. Such highly specific URI patterns can indicate attempted exploitation workflows that rely on malformed or targeted request parameters. Detection relies on proxy logs capturing the HTTP method and the full requested URI, including query strings.
references:
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
- attack.command-and-control
- cve.2023-36884
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
c-uri|contains: /MSHTML_C7/
c-uri|re: \?d=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 0066d244-c277-4c3e-88ec-9e7b777cc8bc
type: derived