Browse detections by severity and log source, with YAML and sample events one click away.
Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884
Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884
Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884
Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884
Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884