cve.2023-36884

Potential CVE-2023-36884 Exploitation - File Downloads

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

Potential CVE-2023-36884 Exploitation - Share Access

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

Potential CVE-2023-36884 Exploitation - URL Marker

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

Potential CVE-2023-36884 Exploitation Dropped File

Aug 12, 2024 · attack.persistence attack.defense-evasion cve.2023-36884 detection.emerging-threats ·

Share on:

Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

Potential CVE-2023-36884 Exploitation Pattern

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

Potential CVE-2303-36884 URL Request Pattern Traffic

Aug 12, 2024 · attack.command-and-control cve.2023-36884 detection.emerging-threats ·

Share on:

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884