Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
2
Contributors
5
2
1
Categories
4
3
2
1
1
Platforms
8
Products / Services
3
2
2
1
1
MITRE Techniques
5
4
4
4
2
CVEs
71
71
64
58
49
Detects Microsoft Outlook initiating outbound SMB or WebDAV network connections to external IP addresses. This behavior is indicative of exploitation of CVE-2023-23397, where a malicious reminder sound or attachment forces the victim's client to authenticate against an attacker-controlled remote share, potentially leaking NTLM hashes.
Detects (failed) outbound connection attempts to internet-facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397, which is a critical elevation of privilege vulnerability in Microsoft Outlook. The vulnerability allows an attacker to send a specially crafted email that, when opened, causes the victim's system to connect to an attacker-controlled SMB share and leak the victim's NTLM hash. This rule specifically looks for SMB client connectivity events (Event IDs 30803, 30804, 30806) where the destination IP address is not a private or loopback address, indicating an attempt to connect to an external SMB server.
The following analytic detects the execution of rundll32.exe with command-line arguments loading davclnt.dll and the davsetcookie function to access a remote WebDav instance. It uses data from Endpoint Detection and Response (EDR) agents, correlating process execution and network traffic data. This activity is significant as it may indicate exploitation of CVE-2023-23397, a known vulnerability. If confirmed malicious, this could allow an attacker to establish unauthorized remote connections, potentially leading to data exfiltration or further network compromise.
The analytic identifies the execution of rundll32.exe with command-line arguments loading davclnt.dll and the davsetcookie function to access a remote WebDAV instance. This activity is significant as it may indicate an attempt to exploit CVE-2023-23397, a known vulnerability. If confirmed malicious, this could allow an attacker to execute remote code or exfiltrate data, posing a severe threat to the environment.
Detects Microsoft Outlook attempting to initiate a connection to a WebDAV or SMB share by querying specific registry keys. This behavior is indicative of an exploitation attempt related to CVE-2023-23397, where an attacker could force Outlook to connect to a malicious share and leak NTLM hashes.
Detects changes to Outlook registry values indicating a reminder was triggered for a Note or Task item. This activity could be related to the exploitation of CVE-2023-23397, a critical vulnerability in Microsoft Outlook that allows for NTLM relay attacks without user interaction. Further investigation is required to determine the success of an exploitation.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397