Browse Rules

CVE-2023-23397 Exploitation Attempt

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

CVE-2023-23397 Exploitation Attempt

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

SUSP_EXPL_Msg_CVE_2023_23397_Mar23 [yara]

MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397

Potential CVE-2023-23397 Exploitation Attempt - SMB

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Potential CVE-2023-23397 Exploitation Attempt - SMB

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 [yara]

Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix.

EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 [yara]

Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)

Suspicious WebDav Client Execution Via Rundll32.EXE

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

Outlook Task/Note Reminder Received

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Suspicious WebDav Client Execution Via Rundll32.EXE

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

Outlook Task/Note Reminder Received

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Outlook Task/Note Reminder Received

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Potential CVE-2023-23397 [splunk-sysmon]

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. This use case looks for svchost spawning rundll with DavSetCookie, which may indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28 (Fancy Bear, Forest Blizzard, STRONTIUM)

Potential CVE-2023-23397 [snowflake-crowdstrikefdr_process]

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. This use case looks for svchost spawning rundll with DavSetCookie, which may indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28 (Fancy Bear, Forest Blizzard, STRONTIUM)

Potential CVE-2023-23397 [splunk-winevent]

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. This use case looks for svchost spawning rundll with DavSetCookie, which may indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28 (Fancy Bear, Forest Blizzard, STRONTIUM)

Potential CVE-2023-23397 [splunk-edr]

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. This use case looks for svchost spawning rundll with DavSetCookie, which may indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28 (Fancy Bear, Forest Blizzard, STRONTIUM)

Windows Rundll32 WebDav With Network Connection

The following analytic detects the execution of rundll32.exe with command-line arguments loading davclnt.dll and the davsetcookie function to access a remote WebDav instance. It uses data from Endpoint Detection and Response (EDR) agents, correlating process execution and network traffic data. This activity is significant as it may indicate exploitation of CVE-2023-23397, a known vulnerability. If confirmed malicious, this could allow an attacker to establish unauthorized remote connections, pot

Windows Rundll32 WebDAV Request

The following analytic identifies the execution of rundll32.exe with command-line arguments loading davclnt.dll and the davsetcookie function to access a remote WebDAV instance. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt to exploit CVE-2023-23397, a known vulnerability. If confirmed malicious, this could allow an attacker to execute remote code o