Suspicious Proxy GET Requests for File Download Paths Indicative of CVE-2023-36884

title: Suspicious Proxy GET Requests for File Download Paths Indicative of CVE-2023-36884
id: e87ffc07-967b-45ff-ad1e-c83d91e45e55
status: test
description: This rule flags proxy events where HTTP GET requests target specific file-download related URI paths that are consistent with attempts to deliver malicious content. Such behavior matters because it can indicate exploitation workflows that retrieve payloads or staged files through attacker-controlled web infrastructure. Detection relies on proxy telemetry capturing the HTTP method and the requested URI.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_traffic.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
  - attack.command-and-control
  - cve.2023-36884
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|contains:
      - /ex001.url
      - /file001.search-ms
      - /file001.url
      - /file001.vbs
      - /file1.mht
      - /o2010.asp
      - /redir_obj.html
      - /RFile.asp
      - /zip_k.asp
      - /zip_k2.asp
      - /zip_k3.asp
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6af1617f-c179-47e3-bd66-b28034a1052d
    type: derived