Potential CVE-2023-36884 Exploitation Dropped File

Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

View on GitHub Open raw file

Detection logic

selection

TargetFilename|startswith: C:\Users\
TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\
TargetFilename|endswith: \file001.url

Condition

selection

Raw YAML

title: Potential CVE-2023-36884 Exploitation Dropped File
id: 8023d3a2-dcdc-44da-8fa9-5c7906e55b38
status: test
description: Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884
references:
    - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
    - https://twitter.com/wdormann/status/1679184475677130755
    - https://twitter.com/r00tbsd/status/1679042071477338114/photo/1
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2023-07-13
tags:
    - attack.persistence
    - cve.2023-36884
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|contains: '\AppData\Roaming\Microsoft\Office\Recent\'
        TargetFilename|endswith: '\file001.url'
    condition: selection
falsepositives:
    - Unknown
level: medium

False positives

Unknown

References

Similar rules

Pingback Backdoor File Indicators

high

windows · Same logsource category (file_event)

Potential COLDSTEEL Persistence Service DLL Creation

high

windows · Same logsource category (file_event)

Potential COLDSTEEL RAT File Indicators

high

windows · Same logsource category (file_event)

APT29 2018 Phishing Campaign File Indicators

critical

windows · Same logsource category (file_event)