Potential CVE-2023-36884 Exploitation - URL Marker

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects a unique URL marker '/MSHTML_C7/' used in GET requests, which has been associated with RomCom exploitation attempts, potentially leveraging CVE-2023-36884. This marker is indicative of command and control communication or initial access related to the exploit.