Anvilogic critical experimental other

Potential CVE-2023-23397 [snowflake-crowdstrikefdr_process]

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. This use case looks for svchost spawning rundll with DavSetCookie, which may indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28 (Fancy Bear, Forest Blizzard, STRONTIUM)

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and process_path ilike '%rundll32.exe' and parent_process_name ilike '%svchost.exe' and regexp_like(process, '.*(davclnt.dll.*DavSetCookie.*://\\\d{1,3}\\\.\\\d{1,3}\\\.\\\d{1,3}\\\.\\\d{1,3}).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...