Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Potential CVE-2023-36033 Exploitation via Protocol Handler Execution
id: d8ee069a-079d-4290-8910-b711d729a50e
status: experimental
description: |
Detects potential exploitation of CVE-2023-36033 (CISA KEV-listed).
Attackers bypass Mark-of-the-Web (MotW) protections by using URL protocol handlers
(search-ms:, search:, or ms-browser-extension:) via Office applications or command-line
execution to load malicious payloads from network shares without triggering SmartScreen warnings.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-36033
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36033
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: SARA Detection Engineering
date: 2026-08-15
tags:
- attack.t1218
- attack.t1059.003
- attack.t1204.002
- attack.t1553
logsource:
category: process_creation
product: windows
detection:
selection_protocol_cli:
CommandLine|contains:
- 'search-ms:'
- 'search:'
- 'ms-browser-extension:'
selection_protocol_office:
ParentImage|endswith:
- '\excel.exe'
- '\winword.exe'
- '\outlook.exe'
- '\powerpnt.exe'
CommandLine|contains:
- 'search-ms:'
- 'search:'
- 'ms-browser-extension:'
selection_explorer_share:
Image|endswith: '\explorer.exe'
CommandLine|contains:
- '\\\\'
- '.lnk'
- '.url'
filter_legit_search:
ParentImage|endswith: '\SearchHost.exe'
CommandLine|contains: 'search-ms:query='
condition: (1 of selection_protocol_*) or (selection_explorer_share and not filter_legit_search)
falsepositives:
- Legitimate internal use of custom search protocols via Windows Explorer.
- System administration scripts utilizing UNC paths for software deployment.
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →