cve.2023-23397

CVE-2023-23397 Exploitation Attempt

Aug 12, 2024 · attack.credential-access attack.initial-access cve.2023-23397 detection.emerging-threats ·

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

Outlook Task/Note Reminder Received

Aug 12, 2024 · attack.persistence attack.t1137 cve.2023-23397 detection.emerging-threats ·

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Potential CVE-2023-23397 Exploitation Attempt - SMB

Aug 12, 2024 · attack.exfiltration cve.2023-23397 detection.emerging-threats ·

Share on:

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Suspicious WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 cve.2023-23397 ·

Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397