Microsoft Outlook Vulnerability Exploitation
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Microsoft Outlook Vulnerability Exploitation
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "Outlook Connecting to WebDAV or SMB Share" AND (IsVulnerable(HOSTNAME, "CVE-2023-23397"))
Action2:
actionname = "suspicious_webdav_client_execution_via_rundll32.exe" AND (IsVulnerable(HOSTNAME, "CVE-2023-23397"))
sequence:Action1 followedby Action2 within 10m
select Action1.HOSTNAME,Action1.MESSAGE,Action1.DOMAIN,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.OBJECTSERVER,Action1.ACCESSES,Action1.ACCESSLIST,Action2.HOSTNAME,Action2.MESSAGE,Action2.PROCESSNAME,Action2.COMMANDLINE,Action2.USERNAME,Action2.PARENTPROCESSNAME,Action2.PARENTPROCESSCOMMANDLINE
Detection
Execution Mode
realtime
Log Sources
Windows
