// [CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability
//
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
// https://www.reddit.com/r/crowdstrike/comments/14y1yei/20230712_situational_awareness_microsoft_office/
//
// Identify Word documents being written to disk with a .url extension.

event_platform=Win #event_simpleName=/^(MSDocxFileWritten)$/ TargetFileName=/\.url$/ 
| TargetFileName=/\.+\(?<FileName>.+\..+)/i 
| select([@timestamp, aid, FileName, TargetFileName])