MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•19

Detects GET requests to specific files ('/human2.aspx' or '/_human2.aspx') that are known indicators of exploitation attempts targeting the MOVEit Transfer vulnerability CVE-2023-34362. These requests are typically associated with web shell deployment or interaction after initial compromise.