CVE-2023-23397 - Microsoft Outlook EoP

### CVE-2023-23397 - Critical Elevation of Privilege vulnerability in Microsoft Outlook #### Summary Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure. #### Affected Products All supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected. #### Technical Details CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required. The threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication. **This playbook should be triggered manually or can be configured as a job.** Please create a new incident and choose the CVE-2023-23397 - Microsoft Outlook EoP playbook and Rapid Breach Response incident type. **The playbook includes the following tasks:** **Hunting:** - Panorama Threat IDs - Cortex XDR - XQL hunting query - BTP hunting - Microsoft PowerShell hunting script - Advanced SIEM hunting queries - Indicators hunting - Endpoint by CVE hunting **Mitigations:** - Cortex XDR Advanced API Monitoring - Microsoft official CVE-2023-23397 patch - Microsoft workarounds - Detection Rules - Yara **References:** [Microsoft Mitigates Outlook Elevation of Privilege Vulnerability](https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/) [CVE-2023-23397 Audit & Eradication Script](https://github.com/microsoft/CSS-Exchange/blob/a4c096e8b6e6eddeba2f42910f165681ed64adf7/docs/Security/CVE-2023-23397.md) [Neo23x0 Yara Rules](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2023_23397.yar) Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

CVE-2023-23397 - Microsoft Outlook EoP · 57 tasks · 6 inputs · 0 outputs

Details

IDCVE-2023-23397 - Microsoft Outlook EoP
From Version6.8.0
Tasks57

README

CVE-2023-23397 - Critical Elevation of Privilege vulnerability in Microsoft Outlook

Summary

Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.

Affected Products

All supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.

Technical Details

CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.

The threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication.

This playbook should be triggered manually or can be configured as a job.
Please create a new incident and choose the CVE-2023-23397 - Microsoft Outlook EoP playbook and Rapid Breach Response incident type.

The playbook includes the following tasks:

Hunting:

  • Panorama Threat IDs
  • Cortex XDR
  • XQL hunting query
  • BTP hunting
  • Microsoft PowerShell hunting script
  • Advanced SIEM hunting queries
  • Indicators hunting
  • Endpoint by CVE hunting

Mitigations:

  • Cortex XDR Advanced API Monitoring
  • Microsoft official CVE-2023-23397 patch
  • Microsoft workarounds
  • Detection Rules
    • Yara

References:

Microsoft Mitigates Outlook Elevation of Privilege Vulnerability

CVE-2023-23397 Audit & Eradication Script

Neo23x0 Yara Rules

Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Search Endpoint by CVE - Generic
  • Outlook initiating connection to WebDAV or SMB share
  • Block Indicators - Generic v3
  • Threat Hunting - Generic
  • Process Email - Generic v2
  • Rapid Breach Response - Set Incident Info
  • Panorama Query Logs

Integrations

  • Elasticsearch v2

Scripts

  • CreateNewIndicatorsOnly
  • ParseHTMLIndicators
  • HttpV2

Commands

  • es-eql-search
  • xdr-xql-generic-query
  • associateIndicatorsToIncident
  • xdr-get-alerts
  • azure-log-analytics-execute-query
  • splunk-search

Playbook Inputs

Name Description Default Value Required
PlaybookDescription The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook. ### CVE-2023-23397 - Critical Elevation of Privilege vulnerability in Microsoft Outlook

#### Summary
Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.

#### Affected Products
All supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.

#### Technical Details
CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.

The threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication.

This playbook should be triggered manually or can be configured as a job.
Please create a new incident and choose the CVE-2023-23397 - Microsoft Outlook EoP playbook and Rapid Breach Response incident type.

The playbook includes the following tasks:

Hunting:
- Panorama Threat IDs
- Cortex XDR
- XQL hunting query
- BTP hunting
- Microsoft PowerShell hunting script
- Advanced SIEM hunting queries
- Indicators hunting
- Endpoint by CVE hunting

Mitigations:
- Cortex XDR Advanced API Monitoring
- Microsoft official CVE-2023-23397 patch
- Microsoft workarounds
- Detection Rules
- Yara

References:

Microsoft Mitigates Outlook Elevation of Privilege Vulnerability

CVE-2023-23397 Audit & Eradication Script

Neo23x0 Yara Rules

Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.		 Optional
autoBlockIndicators Whether to block the indicators automatically. False Optional
QRadarTimeRange The time range to search for indicators in the Threat Hunting - Generic playbook. LAST 7 DAYS Optional
SplunkEarliestTime The earliest time to search for indicators in the Threat Hunting - Generic playbook. -7d@d Optional
SplunkLatestTime The latest time to search for indicators in the Threat Hunting - Generic playbook. now Optional
XQLTimeRange The time range for the Cortex XDR XQL query. 7 days ago Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

CVE-2023-23397 - Microsoft Outlook EoP

Inputs

  • PlaybookDescription — The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook.
  • autoBlockIndicators — Whether to block the indicators automatically.
  • QRadarTimeRange — The time range to search for indicators in the Threat Hunting - Generic playbook.
  • SplunkEarliestTime — The earliest time to search for indicators in the Threat Hunting - Generic playbook.
  • SplunkLatestTime — The latest time to search for indicators in the Threat Hunting - Generic playbook.
  • XQLTimeRange — The time range for the Cortex XDR XQL query.

Commands used

associateIndicatorsToIncident azure-log-analytics-execute-query es-eql-search splunk-search xdr-get-alerts xdr-xql-generic-query

Flowchart

Yes Yes Yes yes yes Manual Yes yes yes Yes yes Start Start Collect Indicators Collect Indicators Microsoft PS hunting script - HttpV2 Microsoft PS hunting script HttpV2 Tag Indicators Tag Indicators Link Indicators To Incident - associateIndicatorsToIncident Link Indicators To Incident associateIndicatorsToIncident Tag CVE Indicators - CreateNewIndicatorsOnly Tag CVE Indicators CreateNewIndicatorsOnly Threat Hunting Threat Hunting SIEM Advanced Hunting SIEM Advanced Hunting Is Splunk Enabled? Is Splunk Enabled? Is QRadar Enabled? Is QRadar Enabled? Set Rapid Breach Response Layout Set Rapid Breach Response... Rapid Breach Response - Set Incident Info - Rapid Breach Response - Set Incident Info Rapid Breach Response - S... Rapid Breach Response - Set I... Is Elasticsearch Enabled? Is Elasticsearch Enabled? Is Azure Log Analytics Enabled? Is Azure Log Analytics En... Outlook initiating connection to WebDAV or SMB share - azure-log-analytics-execute-query Outlook initiating connec... azure-log-analytics-execute-q... Outlook initiating connection to WebDAV or SMB share - splunk-search Outlook initiating connec... splunk-search Outlook initiating connection to WebDAV or SMB share - es-eql-search Outlook initiating connec... es-eql-search Collect IoCs from DeepInstinct - ParseHTMLIndicators Collect IoCs from DeepIns... ParseHTMLIndicators Download IR Tools Download IR Tools Tag IP Indicators - CreateNewIndicatorsOnly Tag IP Indicators CreateNewIndicatorsOnly Outlook initiating connection to WebDAV or SMB share - QRadarFullSearch Outlook initiating connec... QRadarFullSearch PowerShell Hunting PowerShell Hunting Run CVE-2023-23397 hunting script Run CVE-2023-23397 huntin... Verify PowerShell hunting script results Verify PowerShell hunting... Found suspicious email files? Found suspicious email fi... Upload email files for analysis? Upload email files for an... Process Email - Generic v2 - Process Email - Generic v2 Process Email - Generic v2 Process Email - Generic v2 Upload suspicious emails for processing Upload suspicious emails ... Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Resolution Resolution Should block indicators automatically? Should block indicators a... Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Handle indicators manually Handle indicators manually Investigate further Investigate further Done Done Indicators Hunting Indicators Hunting Review found email files manually Review found email files ... Mitigation Mitigation Microsoft mitigating factors Microsoft mitigating factors Patch vulnerable servers Patch vulnerable servers Download Signatures Download Signatures Download Yara Rules - HttpV2 Download Yara Rules HttpV2 Deploy Yara rules Deploy Yara rules Cortex XDR Cortex XDR Suspicious WebDAV request to an external destination - xdr-xql-generic-query Suspicious WebDAV request... xdr-xql-generic-query Is Cortex XDR XQL Query Engine Enabled? Is Cortex XDR XQL Query E... Should continue with the investigation? Should continue with the ... IPS Signatures IPS Signatures Panorama Query Logs - Panorama Query Logs Panorama Query Logs Panorama Query Logs Search Endpoint by CVE - Generic - Search Endpoint by CVE - Generic Search Endpoint by CVE - ... Search Endpoint by CVE - Generic Endpoints by CVE Hunting Endpoints by CVE Hunting XQL Hunting XQL Hunting BTP Hunting BTP Hunting Search CVE-2023-23397 alerts - xdr-get-alerts Search CVE-2023-23397 alerts xdr-get-alerts Found relevant alerts? Found relevant alerts? Respond to exploitation attempts caught by Cortex XDR Respond to exploitation a... Cortex XDR Advanced API Monitoring Cortex XDR Advanced API M...

Source

playbook-CVE-2023-23397_-_Microsoft_Outlook_EoP.yml
Download History Raw 
id: CVE-2023-23397 - Microsoft Outlook EoP
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: CVE-2023-23397 - Microsoft Outlook EoP
description: "### CVE-2023-23397 - Critical Elevation of Privilege vulnerability in Microsoft Outlook \n\n#### Summary \nMicrosoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\n\n#### Affected Products \nAll supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.\n\n#### Technical Details \nCVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\n\nThe threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication.\n\n**This playbook should be triggered manually or can be configured as a job.** \nPlease create a new incident and choose the CVE-2023-23397 - Microsoft Outlook EoP  playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**Hunting:**\n- Panorama Threat IDs\n- Cortex XDR\n - XQL hunting query\n - BTP hunting\n- Microsoft PowerShell hunting script\n- Advanced SIEM hunting queries\n- Indicators hunting\n- Endpoint by CVE hunting\n\n**Mitigations:**\n- Cortex XDR Advanced API Monitoring \n- Microsoft official CVE-2023-23397 patch\n- Microsoft workarounds\n- Detection Rules\n    - Yara\n\n**References:**\n\n[Microsoft Mitigates Outlook Elevation of Privilege Vulnerability](https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/)\n\n[CVE-2023-23397 Audit & Eradication Script](https://github.com/microsoft/CSS-Exchange/blob/a4c096e8b6e6eddeba2f42910f165681ed64adf7/docs/Security/CVE-2023-23397.md)\n\n[Neo23x0 Yara Rules](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2023_23397.yar)\n\nNote: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bd42e131-7786-4323-8b35-24d1dad54c7d
    type: start
    task:
      id: bd42e131-7786-4323-8b35-24d1dad54c7d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "21"
      - "45"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 7a739880-3046-4242-8d50-c13a52fcb7f0
    type: title
    task:
      id: 7a739880-3046-4242-8d50-c13a52fcb7f0
      version: -1
      name: Collect Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: f7c3c819-2753-4ace-837e-9769e81fe94f
    type: regular
    task:
      id: f7c3c819-2753-4ace-837e-9769e81fe94f
      version: -1
      name: Microsoft PS hunting script
      description: Sends a HTTP request with advanced capabilities
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      filename:
        simple: CVE-2023-23397.ps1
      method:
        simple: GET
      save_as_file:
        simple: "yes"
      unsecure:
        simple: "True"
      url:
        simple: https://raw.githubusercontent.com/microsoft/CSS-Exchange/a4c096e8b6e6eddeba2f42910f165681ed64adf7/Security/src/CVE-2023-23397/CVE-2023-23397.ps1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 3a095627-b3bc-40b1-8339-880228454052
    type: title
    task:
      id: 3a095627-b3bc-40b1-8339-880228454052
      version: -1
      name: Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "4"
      - "22"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: ecae4e8f-ad21-4c88-8966-fc944e278ce8
    type: regular
    task:
      id: ecae4e8f-ad21-4c88-8966-fc944e278ce8
      version: -1
      name: Link Indicators To Incident
      description: commands.local.cmd.associate.indicators
      script: Builtin|||associateIndicatorsToIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      incidentId:
        complex:
          root: incident
          accessor: id
      indicatorsValues:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: CVE.ID
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 20,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 7497b20c-4a71-4ace-8667-8b3966a3dbfb
    type: regular
    task:
      id: 7497b20c-4a71-4ace-8667-8b3966a3dbfb
      version: -1
      name: Tag CVE Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      indicator_values:
        complex:
          root: CVE
          accessor: ID
      tags:
        simple: Outlook, 0-day, Microsoft
      type:
        simple: CVE
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 1e73b8a6-8a8a-4f3d-83ef-266aa18ac1e0
    type: title
    task:
      id: 1e73b8a6-8a8a-4f3d-83ef-266aa18ac1e0
      version: -1
      name: Threat Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "48"
      - "24"
      - "52"
      - "55"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 6ea5aa7f-1841-4b16-8b07-79a47f40b4d2
    type: title
    task:
      id: 6ea5aa7f-1841-4b16-8b07-79a47f40b4d2
      version: -1
      name: SIEM Advanced Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
      - "9"
      - "14"
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 6fcb025d-b484-45a8-854d-d192dc2c2018
    type: condition
    task:
      id: 6fcb025d-b484-45a8-854d-d192dc2c2018
      version: -1
      name: Is Splunk Enabled?
      description: Check if Splunk instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: SplunkPy
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1820,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 06781b54-f0c3-48e4-82eb-79543c8e7c1f
    type: condition
    task:
      id: 06781b54-f0c3-48e4-82eb-79543c8e7c1f
      version: -1
      name: Is QRadar Enabled?
      description: Check if Splunk instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar_v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 8922c3be-3c1d-4941-8d38-55857dc9b958
    type: title
    task:
      id: 8922c3be-3c1d-4941-8d38-55857dc9b958
      version: -1
      name: Set Rapid Breach Response Layout
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 9f97d379-0e72-428a-8918-07827bcbd28e
    type: playbook
    task:
      id: 9f97d379-0e72-428a-8918-07827bcbd28e
      version: -1
      name: Rapid Breach Response - Set Incident Info
      description: This playbook is responsible for setting up the Rapid Breach Response Incident Info tab in the layout.
      playbookName: Rapid Breach Response - Set Incident Info
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      SourceOfIndicators:
        simple: https://www.deepinstinct.com/blog/cve-2023-23397-exploitations-in-the-wild-what-you-need-to-know
      countTotalIndicators:
        complex:
          root: CVE
          accessor: ID
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: IP.Address
                iscontext: true
          - operator: uniq
          - operator: count
      playbookDescription:
        complex:
          root: inputs.PlaybookDescription
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: ca9cf476-fca8-4acb-86e9-ab0121f68cc5
    type: condition
    task:
      id: ca9cf476-fca8-4acb-86e9-ab0121f68cc5
      version: -1
      name: Is Elasticsearch Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Elasticsearch
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2260,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: b6ec351d-ed28-4871-8494-61059e65fb4b
    type: condition
    task:
      id: b6ec351d-ed28-4871-8494-61059e65fb4b
      version: -1
      name: Is Azure Log Analytics Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Azure Log Analytics
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 940,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 7263efc3-44ff-4615-8714-72d26b664a30
    type: regular
    task:
      id: 7263efc3-44ff-4615-8714-72d26b664a30
      version: -1
      name: Outlook initiating connection to WebDAV or SMB share
      description: |-
        Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation, based on the following Sigma rule:

        [CVE-2023-23397 Exploitation Attempt](https://github.com/SigmaHQ/sigma/blob/b52abdef5c2929933dbaee5ae5a2edd1be0981c5/rules/windows/builtin/security/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml)
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      query:
        simple: SecurityEvent | where ((EventID == 4656 or EventID == 4663) and ProcessName endswith @'\OUTLOOK.EXE' and Accesses contains 'Query key value' and ObjectName contains @'\REGISTRY\MACHINE\SYSTEM' and ObjectName contains @'Services\' and (ObjectName endswith @'WebClient\NetworkProvider' or ObjectName endswith @'LanmanWorkstation\NetworkProvider'))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 940,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 758ee825-a395-49f3-8931-d9cfd7a7fef8
    type: regular
    task:
      id: 758ee825-a395-49f3-8931-d9cfd7a7fef8
      version: -1
      name: Outlook initiating connection to WebDAV or SMB share
      description: |-
        Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation, based on the following Sigma rule:

        [CVE-2023-23397 Exploitation Attempt](https://github.com/SigmaHQ/sigma/blob/b52abdef5c2929933dbaee5ae5a2edd1be0981c5/rules/windows/builtin/security/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml)
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      query:
        simple: source="WinEventLog:Security" AND ((EventCode="4656" OR EventCode="4663") AND ProcessName="*\\OUTLOOK.EXE" AND Accesses="*Query key value*" AND ObjectName="*\\REGISTRY\\MACHINE\\SYSTEM*" AND ObjectName="*Services\\*" AND (ObjectName="*WebClient\\NetworkProvider" OR ObjectName="*LanmanWorkstation\\NetworkProvider"))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1820,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 91462db8-0dd2-4fe5-8cd1-dd9232068bdf
    type: regular
    task:
      id: 91462db8-0dd2-4fe5-8cd1-dd9232068bdf
      version: -1
      name: Outlook initiating connection to WebDAV or SMB share
      description: |-
        Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation, based on the following Sigma rule:

        [CVE-2023-23397 Exploitation Attempt](https://github.com/SigmaHQ/sigma/blob/b52abdef5c2929933dbaee5ae5a2edd1be0981c5/rules/windows/builtin/security/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml)
      script: Elasticsearch v2|||es-eql-search
      type: regular
      iscommand: true
      brand: Elasticsearch v2
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      query:
        simple: (winlog.channel:"Security" AND winlog.event_id:("4656" OR "4663") AND winlog.event_data.ProcessName:*\\OUTLOOK.EXE AND Accesses:*Query\ key\ value* AND winlog.event_data.ObjectName:*\\REGISTRY\\MACHINE\\SYSTEM* AND winlog.event_data.ObjectName:*Services\\* AND winlog.event_data.ObjectName:(*WebClient\\NetworkProvider OR *LanmanWorkstation\\NetworkProvider))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2260,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 0a9d4c6b-0ab3-4943-803d-71b29d3b0e07
    type: regular
    task:
      id: 0a9d4c6b-0ab3-4943-803d-71b29d3b0e07
      version: -1
      name: Collect IoCs from DeepInstinct
      description: This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      url:
        simple: https://www.deepinstinct.com/blog/cve-2023-23397-exploitations-in-the-wild-what-you-need-to-know
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 10cb142b-1fe1-48e7-8623-786730a9751a
    type: title
    task:
      id: 10cb142b-1fe1-48e7-8623-786730a9751a
      version: -1
      name: Download IR Tools
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 26abc62b-b777-4bba-880c-18999fa2941d
    type: regular
    task:
      id: 26abc62b-b777-4bba-880c-18999fa2941d
      version: -1
      name: Tag IP Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      indicator_values:
        complex:
          root: IP
          accessor: Address
      tags:
        simple: Outlook, 0-day, Microsoft, CVE-2023-23397
      type:
        simple: IP
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 53187120-3a2e-4cbf-84e2-e780714a2926
    type: playbook
    task:
      id: 53187120-3a2e-4cbf-84e2-e780714a2926
      version: -1
      name: Outlook initiating connection to WebDAV or SMB share
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and ("EventID" = '4656' or "EventID" = '4663') and UTF8(payload) ILIKE '%\OUTLOOK.EXE' and UTF8(payload) ILIKE '%Query key value%' and "ObjectName" ilike '%\REGISTRY\MACHINE\SYSTEM%' and "ObjectName" ilike '%Services\%' and ("ObjectName" ilike '%WebClient\NetworkProvider' or "ObjectName" ilike '%LanmanWorkstation\NetworkProvider')
      timeout:
        simple: "600"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 8b035c8c-4c40-4625-840f-c9c639dc3b23
    type: title
    task:
      id: 8b035c8c-4c40-4625-840f-c9c639dc3b23
      version: -1
      name: PowerShell Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: f8d15b87-c50d-4e63-8825-c4a0fcdb1a15
    type: regular
    task:
      id: f8d15b87-c50d-4e63-8825-c4a0fcdb1a15
      version: -1
      name: Run CVE-2023-23397 hunting script
      description: |-
        Please refer to the Microsoft release notes for the full steps needed for the script execution.

        [CVE-2023-23397 PowerShell Hunting Script](https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/)

        The file is ready to be used in the incident War Room, you can also find it by filtering for '**huntingScript**' tag.

        File name: CVE-2023-23397.ps1
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: b474e40e-7ac7-425a-8959-fb22bdec0a67
    type: collection
    task:
      id: b474e40e-7ac7-425a-8959-fb22bdec0a67
      version: -1
      name: Verify PowerShell hunting script results
      description: Check Microsoft PowerShell script execution results for further investigation.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Verify PowerShell hunting script results
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Found any suspicious email files?
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - {}
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Verify PowerShell hunting script results
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 77c7bfcc-db7d-4e3e-8bd7-62cf46be9871
    type: condition
    task:
      id: 77c7bfcc-db7d-4e3e-8bd7-62cf46be9871
      version: -1
      name: Found suspicious email files?
      description: User input for whether results were found in the script execution.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Verify PowerShell hunting script results.Answers
                accessor: "0"
            iscontext: true
          right:
            value:
              simple: "yes"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 65715187-5b3e-4d58-8a66-85b9b72e54f7
    type: condition
    task:
      id: 65715187-5b3e-4d58-8a66-85b9b72e54f7
      version: -1
      name: Upload email files for analysis?
      description: Asks the user for the eml files for further analysis.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Manual:
      - "41"
      "Yes":
      - "30"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: e771792b-2a37-482a-8e6d-f5e5c967eb14
    type: playbook
    task:
      id: e771792b-2a37-482a-8e6d-f5e5c967eb14
      version: -1
      name: Process Email - Generic v2
      description: |
        This playbook adds email details to the relevant context entities and handles original email attachments.

        The v2 playbook enables parsing email artifacts more efficiently, including:
        - Using incident fields and not incident labels.
        - Providing separate paths to "Phishing Alerts".
        - Using the new "Get Original Email - Generic v2" playbook to retrieve original emails as EML files from the following integrations:
          * EWS v2
          * Microsoft Graph Mail integration
          * Gmail
          * FireEye EX and FireEye CM
          * Proofpoint Protection Server
          * Agari Phishing Defense (EWS v2, MSGraph Mail, Gmail)
          * Mimecast
      playbookName: Process Email - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      Email:
        complex:
          root: incident
          accessor: emailto
      EmailCC:
        complex:
          root: incident
          accessor: emailcc
      EmailFileToExtract:
        simple: Inner file
      EmailFormat:
        complex:
          root: incident
          accessor: emailformat
      EmailFrom:
        complex:
          root: incident
          accessor: emailfrom
      EmailHeaders:
        complex:
          root: incident
          accessor: phishingreporteremailheaders
      EmailHtml:
        complex:
          root: incident
          accessor: emailhtml
      EmailSubject:
        complex:
          root: incident
          accessor: emailsubject
      EmailText:
        complex:
          root: incident
          accessor: emailbody
      File:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: eml
              ignorecase: true
      GetOriginalEmail:
        simple: "False"
      MessageID:
        complex:
          root: incident
          accessor: emailmessageid
      Thread-Topic:
        complex:
          root: incident
          accessor: emailsubject
      UserID:
        complex:
          root: incident
          accessor: emailto
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (?i).*<([A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,})>
              replaceWith:
                value:
                  simple: $1
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": -210,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: cb8484a1-06fd-4860-839b-c0a21a9672b1
    type: collection
    task:
      id: cb8484a1-06fd-4860-839b-c0a21a9672b1
      version: -1
      name: Upload suspicious emails for processing
      description: Upload the eml files.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Upload suspicious emails for processing
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
        required: false
        gridcolumns: []
        defaultrows: []
        type: attachments
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Please upload the suspicious email files
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 0f8f299e-2c4f-43ab-8122-d7d6490c2e68
    type: playbook
    task:
      id: 0f8f299e-2c4f-43ab-8122-d7d6490c2e68
      version: -1
      name: Threat Hunting - Generic
      description: "This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: \n- Splunk\n- Qradar\n- Pan-os \n- Cortex data lake \n- Autofocus\n- Microsoft 365 Defender"
      playbookName: Threat Hunting - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      IPAddress:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      QRadarTimeFrame:
        complex:
          root: inputs.QRadarTimeRange
      SplunkEarliestTime:
        complex:
          root: inputs.SplunkEarliestTime
      SplunkLatestTime:
        complex:
          root: inputs.SplunkLatestTime
      URLDomain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: URL.Data
                iscontext: true
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: fb084266-fb76-43f1-85d9-de961a358800
    type: title
    task:
      id: fb084266-fb76-43f1-85d9-de961a358800
      version: -1
      name: Resolution
      description: Whether to continue with the investigation or close it.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 3d691553-ee28-4127-869e-d36dbdf4d365
    type: condition
    task:
      id: 3d691553-ee28-4127-869e-d36dbdf4d365
      version: -1
      name: Should block indicators automatically?
      description: Checks whether to block the indicators automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "37"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoBlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 8adb76c2-29d7-4a2c-8265-3b3eead1988b
    type: playbook
    task:
      id: 8adb76c2-29d7-4a2c-8265-3b3eead1988b
      version: -1
      name: Block Indicators - Generic v3
      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "42"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 670,
          "y": 2890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: fcfdfc90-159d-4a63-80fe-f87316d608c8
    type: regular
    task:
      id: fcfdfc90-159d-4a63-80fe-f87316d608c8
      version: -1
      name: Handle indicators manually
      description: Manual task for indicators handling.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 2890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 9058a036-0cd6-4185-83a7-8b4464b8b6b8
    type: regular
    task:
      id: 9058a036-0cd6-4185-83a7-8b4464b8b6b8
      version: -1
      name: Investigate further
      description: Continue with the investigation manually.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 3720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 88fa96b1-04e6-43f9-8e4c-6ab3c892175b
    type: title
    task:
      id: 88fa96b1-04e6-43f9-8e4c-6ab3c892175b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 2d1c588a-fac4-481a-851c-f23e25c82f96
    type: title
    task:
      id: 2d1c588a-fac4-481a-851c-f23e25c82f96
      version: -1
      name: Indicators Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 1d92b965-f609-4d3b-8e53-f1f706a70eef
    type: regular
    task:
      id: 1d92b965-f609-4d3b-8e53-f1f706a70eef
      version: -1
      name: Review found email files manually
      description: Manual review of the found suspicious email files.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 6ab754aa-b745-44cc-804d-98ad2e5ac9ae
    type: title
    task:
      id: 6ab754aa-b745-44cc-804d-98ad2e5ac9ae
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "43"
      - "44"
      - "47"
      - "62"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 24502910-de52-498a-8d2e-b9b4b872ffea
    type: regular
    task:
      id: 24502910-de52-498a-8d2e-b9b4b872ffea
      version: -1
      name: Microsoft mitigating factors
      description: "#### Protected Users Security Group\n\nAdd users to the Protected Users Security Group, which prevents the use of NTLM as an authentication mechanism.\nPerforming this mitigation makes troubleshooting easier than other methods of disabling NTLM. Consider using it for high value accounts such as Domain Admins when possible. Please note: \nThis may cause impact to applications that require NTLM, however the settings will revert once the user is removed from the Protected Users Group. \n\n#### Block TCP 445/SMB\n\nBlock TCP 445/SMB outbound from your network by using a perimeter firewall, a local firewall, and via your VPN settings. This will prevent the sending of NTLM authentication messages to remote file shares.\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 3220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: c2febb6b-03fc-47b1-8629-8be6e2f9ea5e
    type: regular
    task:
      id: c2febb6b-03fc-47b1-8629-8be6e2f9ea5e
      version: -1
      name: Patch vulnerable servers
      description: |-
        Download Microsoft's latest security updates and patch all vulnerable servers.

        [Microsoft Outlook Elevation of Privilege Vulnerability
        ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 670,
          "y": 3220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: e33c3871-8a14-47bc-8922-592c99eb9159
    type: title
    task:
      id: e33c3871-8a14-47bc-8922-592c99eb9159
      version: -1
      name: Download Signatures
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 10,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: bd7708ca-96ac-46b8-8b2b-992ea353e85a
    type: regular
    task:
      id: bd7708ca-96ac-46b8-8b2b-992ea353e85a
      version: -1
      name: Download Yara Rules
      description: |-
        This file contains multiple Yara rules provided by Neo23x0.

        Reference: [expl_outlook_cve_2023_23397.yar](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2023_23397.yar)
      tags:
      - Yara
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      filename:
        simple: expl_outlook_cve_2023_23397.yar
      method:
        simple: GET
      save_as_file:
        simple: "yes"
      unsecure:
        simple: "True"
      url:
        simple: https://raw.githubusercontent.com/Neo23x0/signature-base/master/yara/expl_outlook_cve_2023_23397.yar
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 10,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: f413179b-6a97-4b55-8106-0965c695d4de
    type: regular
    task:
      id: f413179b-6a97-4b55-8106-0965c695d4de
      version: -1
      name: Deploy Yara rules
      description: |
        The Yara rules file is ready to be used in the incident War Room, you can also find it by filtering for '**Yara**' tag.

        File name: expl_outlook_cve_2023_23397.yar
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 3220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 07bad16d-38de-4090-89bb-ef956027b5fe
    type: title
    task:
      id: 07bad16d-38de-4090-89bb-ef956027b5fe
      version: -1
      name: Cortex XDR
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "57"
      - "58"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -910,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: e12b643b-41dd-4798-8c65-228c46954667
    type: regular
    task:
      id: e12b643b-41dd-4798-8c65-228c46954667
      version: -1
      name: Suspicious WebDAV request to an external destination
      description: |
        #### Looks for svchost initiating a rundll32 WebDAV request to an external destination

        Source: https://twitter.com/ACEResponder/status/1636116096506818562/photo/1
        Reference: https://www.n00py.io/2019/06/understanding-unc-paths-smb-and-webdav/
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      query:
        simple: |-
          dataset = xdr_data
          | filter actor_process_image_name = "rundll32.exe"
          | filter actor_process_command_line contains "DavSetCookie"
          | filter actor_process_command_line contains "http:"
          | filter actor_process_command_line contains "@80" or actor_process_command_line contains "@SSL" or actor_process_command_line contains "@443"
      query_name:
        simple: svchost initiating a rundll32 webdav request to an external destination
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -840,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: e48aa101-a1c1-4374-8375-79dbaff93bcf
    type: condition
    task:
      id: e48aa101-a1c1-4374-8375-79dbaff93bcf
      version: -1
      name: Is Cortex XDR XQL Query Engine Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "49"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex XDR - XQL Query Engine
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -630,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: 25f2cec8-2461-44be-87b1-03b48b68242d
    type: condition
    task:
      id: 25f2cec8-2461-44be-87b1-03b48b68242d
      version: -1
      name: Should continue with the investigation?
      description: Whether to continue with the investigation or close it.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "39"
      "Yes":
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: f461f437-c82b-4f85-8879-4d15921c45e2
    type: title
    task:
      id: f461f437-c82b-4f85-8879-4d15921c45e2
      version: -1
      name: IPS Signatures
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1810,
          "y": 1905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 15447708-b337-4406-8383-6aebfad745fc
    type: playbook
    task:
      id: 15447708-b337-4406-8383-6aebfad745fc
      version: -1
      name: Panorama Query Logs
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      log_type:
        simple: threat
      query:
        simple: (threatid eq 93584) or (threatid eq 1110542)
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -1810,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: f8f5e156-2dfe-4b2c-8ea6-78890edceee8
    type: playbook
    task:
      id: f8f5e156-2dfe-4b2c-8ea6-78890edceee8
      version: -1
      name: Search Endpoint by CVE - Generic
      playbookName: Search Endpoint by CVE - Generic
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      CVE_ID:
        complex:
          root: CVE
          accessor: ID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 2760,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 51bcface-7da2-4e14-8d7f-b45539027380
    type: title
    task:
      id: 51bcface-7da2-4e14-8d7f-b45539027380
      version: -1
      name: Endpoints by CVE Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "54"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2760,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 01eb5e4c-e1e3-478d-8c4c-27badc00c574
    type: title
    task:
      id: 01eb5e4c-e1e3-478d-8c4c-27badc00c574
      version: -1
      name: XQL Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -630,
          "y": 1755
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: 2e11591a-0354-461a-8233-9ea519923ac6
    type: title
    task:
      id: 2e11591a-0354-461a-8233-9ea519923ac6
      version: -1
      name: BTP Hunting
      description: "Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "59"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1210,
          "y": 1755
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: f7d8d3f9-6ca1-4fd9-8d06-e9fdc9f3b572
    type: regular
    task:
      id: f7d8d3f9-6ca1-4fd9-8d06-e9fdc9f3b572
      version: -1
      name: Search CVE-2023-23397 alerts
      description: "Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
      script: '|||xdr-get-alerts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    scriptarguments:
      custom_filter:
        simple: |-
          {
            "AND": [
              {
                "SEARCH_FIELD": "alert_description",
                "SEARCH_TYPE": "CONTAINS",
                "SEARCH_VALUE": "CVE-2023-23397"
              }
            ]
          }
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1210,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: 4aff4c4c-66cc-47f8-84ad-d21edd71c8e7
    type: condition
    task:
      id: 4aff4c4c-66cc-47f8-84ad-d21edd71c8e7
      version: -1
      name: Found relevant alerts?
      description: Checks if alerts were found
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "61"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.Alert
                accessor: alert_description
            iscontext: true
          right:
            value:
              simple: CVE-2023-23397
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1210,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: 697bcc4e-2341-4e37-824c-170b9c90ec7c
    type: regular
    task:
      id: 697bcc4e-2341-4e37-824c-170b9c90ec7c
      version: -1
      name: Respond to exploitation attempts caught by Cortex XDR
      description: Manual response for identified Cortex XDR alerts
      type: regular
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1380,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "62":
    id: "62"
    taskid: 329e5fbc-f706-41a2-836a-a21fdeeff2cc
    type: regular
    task:
      id: 329e5fbc-f706-41a2-836a-a21fdeeff2cc
      version: -1
      name: Cortex XDR Advanced API Monitoring
      description: |-
        To ensure you receive alerts and monitor exploitation attempts:

        1. Verify that you are using Cortex XDR agent version 8.0 and above.
        2. Verify that your agent is updated to content version 910-49200.
        3. Enable ‘Advanced API Monitoring’ in the Malware Profile. Go to Policy Management > 4. Profiles > Malware Profile > Global Behavioral Threat Protection Rules >Advanced API Monitoring and select - Report.
        5. Restart your running outlook applications to ensure full coverage.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 3220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_19_Yes": 0.4,
      "13_40_#default#": 0.1,
      "14_15_yes": 0.4,
      "14_40_#default#": 0.29,
      "27_28_yes": 0.73,
      "27_40_#default#": 0.2,
      "28_30_Yes": 0.43,
      "28_41_Manual": 0.5,
      "35_36_yes": 0.41,
      "50_40_#default#": 0.15,
      "50_49_yes": 0.25,
      "51_39_#default#": 0.49,
      "60_40_#default#": 0.11,
      "60_61_yes": 0.28,
      "8_17_Yes": 0.42,
      "8_40_#default#": 0.12,
      "9_23_Yes": 0.4,
      "9_40_#default#": 0.17
    },
    "paper": {
      "dimensions": {
        "height": 3915,
        "width": 4950,
        "x": -1810,
        "y": 40
      }
    }
  }
inputs:
- key: PlaybookDescription
  value:
    simple: "### CVE-2023-23397 - Critical Elevation of Privilege vulnerability in Microsoft Outlook \n\n#### Summary \nMicrosoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\n\n#### Affected Products \nAll supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.\n\n#### Technical Details \nCVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\n\nThe threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication.\n\n**This playbook should be triggered manually or can be configured as a job.** \nPlease create a new incident and choose the CVE-2023-23397 - Microsoft Outlook EoP  playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**Hunting:**\n- Panorama Threat IDs\n- Cortex XDR\n - XQL hunting query\n - BTP hunting\n- Microsoft PowerShell hunting script\n- Advanced SIEM hunting queries\n- Indicators hunting\n- Endpoint by CVE hunting\n\n**Mitigations:**\n- Cortex XDR Advanced API Monitoring \n- Microsoft official CVE-2023-23397 patch\n- Microsoft workarounds\n- Detection Rules\n    - Yara\n\n**References:**\n\n[Microsoft Mitigates Outlook Elevation of Privilege Vulnerability](https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/)\n\n[CVE-2023-23397 Audit & Eradication Script](https://github.com/microsoft/CSS-Exchange/blob/a4c096e8b6e6eddeba2f42910f165681ed64adf7/docs/Security/CVE-2023-23397.md)\n\n[Neo23x0 Yara Rules](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2023_23397.yar)\n\nNote: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
  required: false
  description: The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook.
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "False"
  required: false
  description: Whether to block the indicators automatically.
  playbookInputQuery:
- key: QRadarTimeRange
  value:
    simple: LAST 7 DAYS
  required: false
  description: The time range to search for indicators in the Threat Hunting -  Generic playbook.
  playbookInputQuery:
- key: SplunkEarliestTime
  value:
    simple: -7d@d
  required: false
  description: The earliest time to search for indicators in the Threat Hunting -  Generic playbook.
  playbookInputQuery:
- key: SplunkLatestTime
  value:
    simple: now
  required: false
  description: The latest time to search for indicators in the Threat Hunting -  Generic playbook.
  playbookInputQuery:
- key: XQLTimeRange
  value:
    simple: 7 days ago
  required: false
  description: The time range for the Cortex XDR XQL query.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.8.0