Hayabusa critical test sigma

CVE-2023-23397 Exploitation Attempt

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": [
      4656,
      4663
    ],
    "ProcessName
| endswith": "\\OUTLOOK.EXE",
    "ObjectName
| contains
| all": [
      "\\REGISTRY\\MACHINE\\SYSTEM",
      "Services\\"
    ],
    "ObjectName
| endswith": [
      "WebClient\\NetworkProvider",
      "LanmanWorkstation\\NetworkProvider"
    ],
    "AccessList
| contains": "%%4416"
  },
  "condition": "security and selection"
}

False Positives

  • ⚠ Searchprotocolhost.exe likes to query these registry keys. To avoid false postives, it's better to filter out those events before they reach the SIEM

Field Validations

Loading…

Comments (0)

Loading comments...