Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

calendar Sep 2, 2024 · attack.persistence attack.t1505.001 cve.2023-27363 detection.emerging-threats  ·
Share on: linkedin copy

Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

Sigma rule (View on GitHub)

 1title: Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader
 2id: 9cae055f-e1d2-4f81-b8a5-1986a68cdd84
 3status: test
 4description: Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.
 5references:
 6    - https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
 7    - https://www.zerodayinitiative.com/advisories/ZDI-23-491/
 8    - https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/
 9author: Gregory
10date: 2023-10-11
11tags:
12    - attack.persistence
13    - attack.t1505.001
14    - cve.2023-27363
15    - detection.emerging-threats
16logsource:
17    product: windows
18    category: file_event
19detection:
20    selection:
21        Image|endswith: '\FoxitPDFReader.exe'
22        TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
23        TargetFilename|endswith: '.hta'
24    condition: selection
25falsepositives:
26    - Unknown
27level: high

References

Related rules

to-top