Webserver GET requests to MOVEit human2.aspx paths indicating CVE-2023-34362 exploitation attempt

title: Webserver GET requests to MOVEit human2.aspx paths indicating CVE-2023-34362 exploitation attempt
id: a37633ed-88cc-46f1-9b4d-51f5a2a5f28f
status: test
description: This rule flags webserver requests using HTTP GET where the requested URI path contains one of the MOVEit-related file names human2.aspx or _human2.aspx. Such requests can be part of exploitation workflows aiming to access or trigger attacker-controlled functionality. It relies on webserver HTTP request telemetry, specifically the request method and URI stem matching those path substrings.
references:
  - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
  - https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-03
modified: 2023-07-28
tags:
  - attack.persistence
  - attack.t1505.003
  - cve.2023-34362
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-stem|contains:
      - /human2.aspx
      - /_human2.aspx
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 435e41f2-48eb-4c95-8a2b-ed24b50ec30b
    type: derived