Potential CVE-2023-36884 Exploitation - Share Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects access to a file share with a specific naming schema ('\MSHTML_C7\' and an IP address pattern) that has been observed during exploitation of CVE-2023-36884. This rule looks for Windows Security Event ID 5140 (A network share object was accessed) where the ShareName or ShareLocalPath contains the characteristic string and an IP address.