Signature Base unknown stable yara

EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 [yara]

Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)

View Source

Detection Logic

(
         uint16(0) == 0xCFD0 and 1 of ($psetid*)
         or
         uint32be(0) == 0x789F3E22
      )
      and any of ( $u* )
      and $rfp
      and not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...