Anvilogic critical experimental spl

Potential CVE-2023-23397 [splunk-edr]

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. This use case looks for svchost spawning rundll with DavSetCookie, which may indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28 (Fancy Bear, Forest Blizzard, STRONTIUM)

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc")) 
OR (TERM(ProcessRollup2) 
OR Type=Process) 
OR TERM(DeviceProcessEvents)) "svchost.exe" "rundll32" "davclnt.dll" "DavSetCookie"
| regex process="(?i)(davclnt.dll.*DavSetCookie.*://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| table _time, host, user signature_id, process, process_*, parent_*
| bin span=1s
| stats values(*) as * by _time, host `hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...