Microsoft Outlook Vulnerability Exploitation
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Microsoft Outlook Vulnerability Exploitation
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "Outlook Connecting to WebDAV or SMB Share" AND (vulnerableTo(HOSTNAME, "CVE-2023-23397")) Action2: actionname = "suspicious_webdav_client_execution_via_rundll32".exe" AND (vulnerableTo(HOSTNAME, "CVE-2023-23397")) sequence:Action1 followedby Action2 within 10m select Action1.HOSTNAME,Action1.MESSAGE,Action1.DOMAIN,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.OBJECTSERVER,Action2.HOSTNAME,Action2.MESSAGE,Action2.PROCESSNAME,Action2.COMMANDLINE,Action2.USERNAME,Action2.PARENTPROCESSNAME,Action2.PARENTPROCESSCOMMANDLINE
Detection
Execution Mode
realtime
Log Sources
Windows
