Potential RomCom CVE-2023-36884 Exploitation - File Downloads

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects HTTP GET requests for specific file paths associated with the RomCom threat actor, potentially exploiting CVE-2023-36884. These file paths include various file types such as .url, .search-ms, .vbs, .mht, and .asp, which are likely used for initial access or further stages of the attack.