Anvilogic critical experimental spl
Potential CVE-2023-23397 [splunk-sysmon]
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. This use case looks for svchost spawning rundll with DavSetCookie, which may indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28 (Fancy Bear, Forest Blizzard, STRONTIUM)
Detection Logic
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1)
OR "<EventID>1<"
OR Type=Process) "svchost.exe" "rundll32" "davclnt.dll" "DavSetCookie"
| regex process="(?i)(davclnt.dll.*DavSetCookie.*://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| table _time, host, user process, process_*, signature_id, parent_*
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...