Windows File Share Access: MSHTML_C7 with IP-like Naming Pattern

title: "Windows File Share Access: MSHTML_C7 with IP-like Naming Pattern"
id: 24fcec58-ae34-4abf-8af0-11392b12a570
status: test
description: This rule flags Windows Security events where an accessed file share name and local share path include the \MSHTML_C7\ component and match an IP-like dotted-quad pattern. Such share naming patterns can indicate exploitation staging or data staging workflows that rely on specific share destinations. The detection relies on Windows Security auditing for file share access (EventID 5140) and the presence of matching values in ShareName and ShareLocalPath.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/win_security_exploit_cve_2023_36884_office_windows_html_rce_share_access_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
  - attack.command-and-control
  - cve.2023-36884
  - detection.emerging-threats
logsource:
  product: windows
  service: security
  definition: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure
detection:
  selection_eid:
    EventID: 5140
  selection_share_name:
    ShareName|contains: \MSHTML_C7\
    ShareName|re: "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  selection_share_path:
    ShareLocalPath|contains: \MSHTML_C7\
    ShareLocalPath|re: "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  condition: selection_eid and 1 of selection_share_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3df95076-9e78-4e63-accb-16699c3b74f8
    type: derived