CVE-2023-23397 Outlook WebDAV/SMB Registry Query

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects Microsoft Outlook attempting to initiate a connection to a WebDAV or SMB share by querying specific registry keys. This behavior is indicative of an exploitation attempt related to CVE-2023-23397, where an attacker could force Outlook to connect to a malicious share and leak NTLM hashes.