Potential CVE-2023-36884 Exploitation by RomCom

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.