Windows File Activity Indicators of Potential MOVEit Transfer CVE-2023-34362 Exploitation

Finds MOVEit Transfer webroot file and ASP.NET compilation artifacts on Windows that may indicate CVE-2023-34362 exploitation.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-06-01
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies file event indicators on Windows systems associated with MOVEit Transfer directories and artifacts commonly observed during exploitation activity. It matters because malicious attempts to abuse MOVEit can result in staging or deployment of payloads and related files within the application’s wwwroot content. The detection relies on file event telemetry, specifically matching TargetFilename paths and extensions as well as known suspicious MOVEit wwwroot human2.aspx artifacts and compiled ASP.NET DLL creation timing patterns.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Cisco IOS XE Configuration Change by Web UI WSMA User

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)

Possible Citrix Bleed Session Token Leak via OpenID Configuration Endpoint (CVE-2023-4966) (via webserver)

Windows File Activity Indicators of Potential MOVEit Transfer CVE-2023-34362 Exploitation

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-event-indicators-of-moveit-transfer-cve-2023-34362-exploitation-art-c3b2a774

title: Windows File Activity Indicators of Potential MOVEit Transfer CVE-2023-34362 Exploitation
id: 77545ec2-ec05-42d6-a497-9402e47c3ca9
status: test
description: This rule identifies file event indicators on Windows systems associated with MOVEit Transfer directories and artifacts commonly observed during exploitation activity. It matters because malicious attempts to abuse MOVEit can result in staging or deployment of payloads and related files within the application’s wwwroot content. The detection relies on file event telemetry, specifically matching TargetFilename paths and extensions as well as known suspicious MOVEit wwwroot human2.aspx artifacts and compiled ASP.NET DLL creation timing patterns.
references:
  - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
  - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
  - https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/
  - https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
modified: 2024-08-13
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-34362
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_generic:
    TargetFilename|contains:
      - \MOVEit Transfer\wwwroot\
      - \MOVEitTransfer\wwwroot\
    TargetFilename|endswith:
      - .7z
      - .bat
      - .dll
      - .exe
      - .ps1
      - .rar
      - .vbe
      - .vbs
      - .zip
  selection_known_ioc:
    TargetFilename|endswith:
      - \MOVEit Transfer\wwwroot\_human2.aspx.lnk
      - \MOVEit Transfer\wwwroot\_human2.aspx
      - \MOVEit Transfer\wwwroot\human2.aspx.lnk
      - \MOVEit Transfer\wwwroot\human2.aspx
      - \MOVEitTransfer\wwwroot\_human2.aspx.lnk
      - \MOVEitTransfer\wwwroot\_human2.aspx
      - \MOVEitTransfer\wwwroot\human2.aspx.lnk
      - \MOVEitTransfer\wwwroot\human2.aspx
  selection_compiled_asp:
    CreationUtcTime|startswith:
      - "2023-03- "
      - "2023-04- "
      - "2023-05- "
      - "2023-06- "
    TargetFilename|contains|all:
      - \Windows\Microsoft.net\Framework64\v
      - \Temporary ASP.NET Files\
      - App_Web_
    TargetFilename|endswith: .dll
  condition: 1 of selection_*
falsepositives:
  - To avoid FP, this rule should only be applied on MOVEit servers.
level: high
license: DRL-1.1
related:
  - id: c3b2a774-3152-4989-83c1-7afc48fd1599
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL