Add rule: rules/windows/file/file_event/file_event_win_cve_2023_27363…

[greg-workspace]

…_foxit_pdf.yml

Summary of the Pull Request

This PR adds a new rule for CVE-2023-27363 exploitation

• When victims open a malicious pdf via Foxit Reader, the vulnerable Foxit Reader may drop malicious .hta file to Startup folder.
• Ref PoC: https://github.com/j00sean/SecBugs/tree/main/CVEs/CVE-2023-27363
• The rule has been verified via Zircolite with Sysmon evtx

Changelog

new: Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader

Example Log Event

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> 
<System> 
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" /> 
<EventID>11</EventID> 
<Version>2</Version> 
<Level>4</Level> 
<Task>11</Task> 
<Opcode>0</Opcode> 
<Keywords>0x8000000000000000</Keywords> 
<TimeCreated SystemTime="2023-05-16T03:05:31.5364462Z" /> 
<EventRecordID>146</EventRecordID> 
<Correlation /> 
<Execution ProcessID="5484" ThreadID="4300" /> 
<Channel>Microsoft-Windows-Sysmon/Operational</Channel> 
<Computer>DESKTOP-2K5M2N9</Computer> 
<Security UserID="S-1-5-18" /> 
</System> 
<EventData> 
<Data Name="RuleName">T1023</Data> 
<Data Name="UtcTime">2023-05-16 03:05:31.525</Data> 
<Data Name="ProcessGuid">{d7c7130f-f2f9-6462-9102-000000004000}</Data> 
<Data Name="ProcessId">6304</Data> 
<Data Name="Image">C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe</Data> 
<Data Name="TargetFilename">C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\evil.hta</Data> 
<Data Name="CreationUtcTime">2023-05-16 03:05:31.525</Data> 
</EventData> 
</Event>

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

file_event_win_startup_folder_file_write is a general detection for files being created in the Windows startup directory.

Can write the rule more generic, I think of 2 possible way:

• list of dangerous extensions which should not be the normal
• when it is not a '.lnk', even if it is a dangerous extensions too

[greg-workspace]

file_event_win_startup_folder_file_write is a general detection for files being created in the Windows startup directory.

Can write the rule more generic, I think of 2 possible way:

• list of dangerous extensions which should not be the normal
• when it is not a '.lnk', even if it is a dangerous extensions too

The rule: file_event_win_cve_2023_27363.yml is in order to hunt malicious PDFs in VirusTotal, and due to the limitation of CVE-2023-27363, only .hta extension is allowed to trigger RCE. However, generic rule can not hunt the specific kind of attack.

[nasbench]

Thanks for the contribution @greg-workspace and sorry this took so long.