Potential CVE-2023-36884 RomCOM URL Request Pattern

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884. The rule looks for GET requests where the URI contains a file extension like .zip, .asp, .htm, .url, .xml, .chm, .mht, .vbs, or .search-ms, followed by '?d=' and an IPv4 address.