Windows Security 5140 File Share Access to MSHTML_C7 IP-Named Paths
Alerts on Windows file share access events targeting \MSHTML_C7\ shares with an IP-like naming pattern (EventID 5140).
FreeReviewedSigma · High · v5
- Product
- windows
- Service
- security
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-13
- Updated
- 2026-07-31
What it detects
This rule flags Windows Security EventID 5140 for access to a file share where the share name and local path both include \MSHTML_C7\ and an IPv4-like dotted-quad pattern. Attackers may use such naming schemes to stage or reach resources during exploitation attempts. It relies on Windows file share access auditing telemetry (5140) and matching patterns in the share name and share local path fields.
Reporting behind it
- blogs.blackberry.comhttps://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/win_security_exploit_cve_2023_36884_office_windows_html_rce_share_access_pattern.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-share-access-mshtml-c7-with-ip-like-naming-pattern-3df95076
title: Windows Security 5140 File Share Access to MSHTML_C7 IP-Named Paths
id: 24fcec58-ae34-4abf-8af0-11392b12a570
status: test
description: This rule flags Windows Security EventID 5140 for access to a file share where the share name and local path both include \MSHTML_C7\ and an IPv4-like dotted-quad pattern. Attackers may use such naming schemes to stage or reach resources during exploitation attempts. It relies on Windows file share access auditing telemetry (5140) and matching patterns in the share name and share local path fields.
references:
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/win_security_exploit_cve_2023_36884_office_windows_html_rce_share_access_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
- attack.command-and-control
- cve.2023-36884
- detection.emerging-threats
logsource:
product: windows
service: security
definition: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure
detection:
selection_eid:
EventID: 5140
selection_share_name:
ShareName|contains: \MSHTML_C7\
ShareName|re: "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
selection_share_path:
ShareLocalPath|contains: \MSHTML_C7\
ShareLocalPath|re: "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
condition: selection_eid and 1 of selection_share_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 3df95076-9e78-4e63-accb-16699c3b74f8
type: derived