Proxy GET Requests for Suspicious File and Redirect Paths Associated with CVE-2023-36884
Alerts on proxy HTTP GET requests for specific suspicious file-download URI patterns associated with CVE-2023-36884-style activity.
FreeReviewedSigma · Medium · v5
- Category
- proxy
- Author
- X__Junior (SigmaHQ), DRL 1.1
- Published
- 2023-07-12
- Updated
- 2026-07-31
What it detects
This rule identifies proxy HTTP GET activity where the requested URI contains specific file and redirect-related path fragments. Such requests can indicate attempted delivery or triggering of malicious content as part of exploiting CVE-2023-36884. Detection relies on proxy telemetry capturing the HTTP method (GET) and the full or partial requested URI.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
suspicious-proxy-get-requests-for-file-download-paths-indicative-of-cve-2023-368-6af1617f
title: Proxy GET Requests for Suspicious File and Redirect Paths Associated with CVE-2023-36884
id: e87ffc07-967b-45ff-ad1e-c83d91e45e55
status: test
description: This rule identifies proxy HTTP GET activity where the requested URI contains specific file and redirect-related path fragments. Such requests can indicate attempted delivery or triggering of malicious content as part of exploiting CVE-2023-36884. Detection relies on proxy telemetry capturing the HTTP method (GET) and the full or partial requested URI.
references:
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_traffic.yml
author: X__Junior, Huntrule Team
date: 2023-07-12
tags:
- attack.command-and-control
- cve.2023-36884
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
c-uri|contains:
- /ex001.url
- /file001.search-ms
- /file001.url
- /file001.vbs
- /file1.mht
- /o2010.asp
- /redir_obj.html
- /RFile.asp
- /zip_k.asp
- /zip_k2.asp
- /zip_k3.asp
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 6af1617f-c179-47e3-bd66-b28034a1052d
type: derived