Windows Office Recent Folder Dropped URL File (file001.url) Creation
Alerts on creation of file001.url in Microsoft Office Recent under C:\Users\, indicating potential exploit staging.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-13
- Updated
- 2026-07-31
What it detects
This rule matches Windows file creation events where a target path under C:\Users\ includes AppData\Roaming\Microsoft\Office\Recent\ and ends with file001.url. Attackers often use Office-related folders to persist or stage dropped artifacts, making this pattern useful for spotting suspicious file drops tied to exploitation activity. Telemetry relies on Windows file event logging that records created file paths and filenames.
Reporting behind it
- blogs.blackberry.comhttps://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- twitter.comhttps://twitter.com/wdormann/status/1679184475677130755
- twitter.comhttps://twitter.com/r00tbsd/status/1679042071477338114/photo/1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/file_event_win_exploit_cve_2023_36884_office_windows_html_rce_file_patterns.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-office-recent-folder-file-drop-c-users-recent-file001-url-8023d3a2
title: Windows Office Recent Folder Dropped URL File (file001.url) Creation
id: 81360185-5fef-495a-8452-5f070543e6eb
status: test
description: This rule matches Windows file creation events where a target path under C:\Users\ includes AppData\Roaming\Microsoft\Office\Recent\ and ends with file001.url. Attackers often use Office-related folders to persist or stage dropped artifacts, making this pattern useful for spotting suspicious file drops tied to exploitation activity. Telemetry relies on Windows file event logging that records created file paths and filenames.
references:
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- https://twitter.com/wdormann/status/1679184475677130755
- https://twitter.com/r00tbsd/status/1679042071477338114/photo/1
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36884/file_event_win_exploit_cve_2023_36884_office_windows_html_rce_file_patterns.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2023-07-13
tags:
- attack.persistence
- cve.2023-36884
- detection.emerging-threats
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith: C:\Users\
TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\
TargetFilename|endswith: \file001.url
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 8023d3a2-dcdc-44da-8fa9-5c7906e55b38
type: derived