Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity
This rule detects file activity indicative of potential exploitation of the MOVEit Transfer CVE-2023-34362 vulnerability. It specifically looks for the creation or modification of suspicious file types (like .7z, .bat, .dll, .exe, .ps1, .rar, .vbe, .vbs, .zip) within the MOVEit Transfer webroot directory. Additionally, it identifies the presence of known malicious files such as `_human2.aspx` or `human2.aspx` and their shortcut files (`.lnk`) within the same directory. The rule also includes a selection for newly compiled ASP.NET DLLs within the temporary ASP.NET files directory, created around the time the vulnerability was actively exploited (March-June 2023), which could indicate the deployment of web shells or other malicious code.
Sigma
