Sigma rule: Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity

Rule

Title

Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2023-06-01

Modified

2024-08-13

File

rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.

Log source

product

windows

category

file_event

Detection

selection_generic:
    TargetFilename|contains:
        - '\MOVEit Transfer\wwwroot\'
        - '\MOVEitTransfer\wwwroot\'
    TargetFilename|endswith:
        - '.7z'
        - '.bat'
        - '.dll'
        - '.exe'
        - '.ps1'
        - '.rar'
        - '.vbe'
        - '.vbs'
        - '.zip'
selection_known_ioc:
    TargetFilename|endswith:
        - '\MOVEit Transfer\wwwroot\_human2.aspx.lnk'
        - '\MOVEit Transfer\wwwroot\_human2.aspx'
        - '\MOVEit Transfer\wwwroot\human2.aspx.lnk'
        - '\MOVEit Transfer\wwwroot\human2.aspx'
        - '\MOVEitTransfer\wwwroot\_human2.aspx.lnk'
        - '\MOVEitTransfer\wwwroot\_human2.aspx'
        - '\MOVEitTransfer\wwwroot\human2.aspx.lnk'
        - '\MOVEitTransfer\wwwroot\human2.aspx'
# Uncomment selection if you wanna threat hunt for additional artifacts
# selection_cmdline:
#    TargetFilename|contains: ':\Windows\TEMP\'
#    TargetFilename|endswith: '.cmdline'
selection_compiled_asp:
    CreationUtcTime|startswith:
        - '2023-03- '
        - '2023-04- '
        - '2023-05- '
        - '2023-06- '
    TargetFilename|contains|all:
        - '\Windows\Microsoft.net\Framework64\v'
        - '\Temporary ASP.NET Files\'
        - 'App_Web_'
    TargetFilename|endswith: '.dll'
condition: 1 of selection_*

False positives (as the rule lists them)

• To avoid FP, this rule should only be applied on MOVEit servers.

Tags

• attack.initial-access
• attack.t1190
• cve.2023-34362
• detection.emerging-threats

CVEs this rule names

• CVE-2023-34362

MITRE ATT&CK ids this rule names

• T1190

References

• https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
• https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
• https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/
• https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml