From 871f41df73e68fc6b16403b3f8a53bbc8b2cd8eb Mon Sep 17 00:00:00 2001 From: Greg <63213860+greg-workspace@users.noreply.github.com> Date: Wed, 11 Oct 2023 19:58:19 +0800 Subject: [PATCH] Merge PR #4239 From @greg-workspace - Add Rule Related To CVE-2023-27363 new: Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader --------- Co-authored-by: Greg Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com> Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com> --- ...ile_event_win_cve_2023_27363_foxit_rce.yml | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml diff --git a/rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml b/rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml new file mode 100644 index 000000000..bc66a3fcc --- /dev/null +++ b/rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml @@ -0,0 +1,26 @@ +title: Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader +id: 9cae055f-e1d2-4f81-b8a5-1986a68cdd84 +status: experimental +description: Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation. +references: + - https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363 + - https://www.zerodayinitiative.com/advisories/ZDI-23-491/ + - https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/ +author: Gregory +date: 2023/10/11 +tags: + - attack.persistence + - attack.t1505.001 + - cve.2023.27363 +logsource: + product: windows + category: file_event +detection: + selection: + Image|endswith: '\FoxitPDFReader.exe' + TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\' + TargetFilename|endswith: '.hta' + condition: selection +falsepositives: + - Unknown +level: high