Signature Base unknown stable yara

EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 [yara]

Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix.

View Source

Detection Logic

all of ($mail*) and all of ($tnef*) and 1 of ($ipm*) and $unc

Field Validations

Loading…

Comments (0)

Loading comments...