Windows Office recent folder file drop: C:\Users\...\Recent\file001.url

title: "Windows Office recent folder file drop: C:\\Users\\...\\Recent\\file001.url"
id: 81360185-5fef-495a-8452-5f070543e6eb
status: test
description: This rule flags creation of a specific URL file (file001.url) within the Microsoft Office Recent folder under a user profile path. Attackers may drop such files to establish persistence or stage additional execution following exploitation attempts. It relies on Windows file creation events that include the full TargetFilename matching the specified directory and filename pattern.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://twitter.com/wdormann/status/1679184475677130755
  - https://twitter.com/r00tbsd/status/1679042071477338114/photo/1
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/file_event_win_exploit_cve_2023_36884_office_windows_html_rce_file_patterns.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
  - attack.persistence
  - cve.2023-36884
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\
    TargetFilename|endswith: \file001.url
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8023d3a2-dcdc-44da-8fa9-5c7906e55b38
    type: derived