Microsoft Outlook CVE-2023-23397

1type: trigger1
2name: crowdsecurity/CVE-2023-23397
3description: "Detect CVE-2023-23397 from sysmon events"
4filter: |2
5  evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1' &&
6  evt.Parsed.ParentImage endsWith "\\svchost.exe" &&
7  evt.Parsed.Image endsWith "\\rundll32.exe" &&
8  evt.Parsed.CommandLine contains "C:\\windows\\system32\\davclnt.dll,DavSetCookie" &&
9  evt.Parsed.CommandLine matches '://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}' &&
10  (not (evt.Parsed.CommandLine contains "://10." ||
11        evt.Parsed.CommandLine contains "://192.168." ||
12        evt.Parsed.CommandLine contains "://172.16." ||
13        evt.Parsed.CommandLine contains "://172.17." ||
14        evt.Parsed.CommandLine contains "://172.18." ||
15        evt.Parsed.CommandLine contains "://172.19." ||
16        evt.Parsed.CommandLine contains "://172.20." ||
17        evt.Parsed.CommandLine contains "://172.21." ||
18        evt.Parsed.CommandLine contains "://172.22." ||
19        evt.Parsed.CommandLine contains "://172.23." ||
20        evt.Parsed.CommandLine contains "://172.24." ||
21        evt.Parsed.CommandLine contains "://172.25." ||
22        evt.Parsed.CommandLine contains "://172.26." ||
23        evt.Parsed.CommandLine contains "://172.27." ||
24        evt.Parsed.CommandLine contains "://172.28." ||
25        evt.Parsed.CommandLine contains "://172.29." ||
26        evt.Parsed.CommandLine contains "://172.30." ||
27        evt.Parsed.CommandLine contains "://172.31." ||
28        evt.Parsed.CommandLine contains "://127." ||
29        evt.Parsed.CommandLine contains "://169.254."))
30labels:
31  notification: true
32  os: windows
33  classification:3
34    - attack.T1068
35    - cve.CVE-2023-23397
36  spoofable: 0
37  confidence: 3
38  behavior: "http:exploit"
39  label: "Microsoft Outlook CVE-2023-23397"
40  service: windows