Potential CVE-2023-36884 Exploitation Dropped File
Detects the creation of a specific '.url' file named 'file001.url' within the 'Recent' folder of Microsoft Office. This activity has been observed in potential exploitation attempts related to CVE-2023-36884, where adversaries drop such files to achieve persistence or execute malicious code.
Sigma
