id: CVE-2023-23397 - Microsoft Outlook EoP version: -1 contentitemexportablefields: contentitemfields: {} name: CVE-2023-23397 - Microsoft Outlook EoP description: "### CVE-2023-23397 - Critical Elevation of Privilege vulnerability in Microsoft Outlook \n\n#### Summary \nMicrosoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\n\n#### Affected Products \nAll supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.\n\n#### Technical Details \nCVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\n\nThe threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication.\n\n**This playbook should be triggered manually or can be configured as a job.** \nPlease create a new incident and choose the CVE-2023-23397 - Microsoft Outlook EoP playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**Hunting:**\n- Panorama Threat IDs\n- Cortex XDR\n - XQL hunting query\n - BTP hunting\n- Microsoft PowerShell hunting script\n- Advanced SIEM hunting queries\n- Indicators hunting\n- Endpoint by CVE hunting\n\n**Mitigations:**\n- Cortex XDR Advanced API Monitoring \n- Microsoft official CVE-2023-23397 patch\n- Microsoft workarounds\n- Detection Rules\n - Yara\n\n**References:**\n\n[Microsoft Mitigates Outlook Elevation of Privilege Vulnerability](https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/)\n\n[CVE-2023-23397 Audit & Eradication Script](https://github.com/microsoft/CSS-Exchange/blob/a4c096e8b6e6eddeba2f42910f165681ed64adf7/docs/Security/CVE-2023-23397.md)\n\n[Neo23x0 Yara Rules](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2023_23397.yar)\n\nNote: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve." starttaskid: "0" tasks: "0": id: "0" taskid: bd42e131-7786-4323-8b35-24d1dad54c7d type: start task: id: bd42e131-7786-4323-8b35-24d1dad54c7d version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" - "21" - "45" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 40 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 7a739880-3046-4242-8d50-c13a52fcb7f0 type: title task: id: 7a739880-3046-4242-8d50-c13a52fcb7f0 version: -1 name: Collect Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "20" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 190 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: f7c3c819-2753-4ace-837e-9769e81fe94f type: regular task: id: f7c3c819-2753-4ace-837e-9769e81fe94f version: -1 name: Microsoft PS hunting script description: Sends a HTTP request with advanced capabilities scriptName: HttpV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: filename: simple: CVE-2023-23397.ps1 method: simple: GET save_as_file: simple: "yes" unsecure: simple: "True" url: simple: https://raw.githubusercontent.com/microsoft/CSS-Exchange/a4c096e8b6e6eddeba2f42910f165681ed64adf7/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 3a095627-b3bc-40b1-8339-880228454052 type: title task: id: 3a095627-b3bc-40b1-8339-880228454052 version: -1 name: Tag Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" - "4" - "22" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: ecae4e8f-ad21-4c88-8966-fc944e278ce8 type: regular task: id: ecae4e8f-ad21-4c88-8966-fc944e278ce8 version: -1 name: Link Indicators To Incident description: commands.local.cmd.associate.indicators script: Builtin|||associateIndicatorsToIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "11" scriptarguments: incidentId: complex: root: incident accessor: id indicatorsValues: complex: root: IP accessor: Address transformers: - operator: append args: item: value: simple: CVE.ID iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 20, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 7497b20c-4a71-4ace-8667-8b3966a3dbfb type: regular task: id: 7497b20c-4a71-4ace-8667-8b3966a3dbfb version: -1 name: Tag CVE Indicators description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue. scriptName: CreateNewIndicatorsOnly type: regular iscommand: false brand: "" nexttasks: '#none#': - "11" scriptarguments: indicator_values: complex: root: CVE accessor: ID tags: simple: Outlook, 0-day, Microsoft type: simple: CVE reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 1e73b8a6-8a8a-4f3d-83ef-266aa18ac1e0 type: title task: id: 1e73b8a6-8a8a-4f3d-83ef-266aa18ac1e0 version: -1 name: Threat Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" - "48" - "24" - "52" - "55" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 6ea5aa7f-1841-4b16-8b07-79a47f40b4d2 type: title task: id: 6ea5aa7f-1841-4b16-8b07-79a47f40b4d2 version: -1 name: SIEM Advanced Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "8" - "9" - "14" - "13" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1600, "y": 1890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 6fcb025d-b484-45a8-854d-d192dc2c2018 type: condition task: id: 6fcb025d-b484-45a8-854d-d192dc2c2018 version: -1 name: Is Splunk Enabled? description: Check if Splunk instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "Yes": - "17" separatecontext: false conditions: - label: "Yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: SplunkPy - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1820, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 06781b54-f0c3-48e4-82eb-79543c8e7c1f type: condition task: id: 06781b54-f0c3-48e4-82eb-79543c8e7c1f version: -1 name: Is QRadar Enabled? description: Check if Splunk instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "Yes": - "23" separatecontext: false conditions: - label: "Yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: QRadar_v2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1380, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 8922c3be-3c1d-4941-8d38-55857dc9b958 type: title task: id: 8922c3be-3c1d-4941-8d38-55857dc9b958 version: -1 name: Set Rapid Breach Response Layout type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "12" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 9f97d379-0e72-428a-8918-07827bcbd28e type: playbook task: id: 9f97d379-0e72-428a-8918-07827bcbd28e version: -1 name: Rapid Breach Response - Set Incident Info description: This playbook is responsible for setting up the Rapid Breach Response Incident Info tab in the layout. playbookName: Rapid Breach Response - Set Incident Info type: playbook iscommand: false brand: "" nexttasks: '#none#': - "6" scriptarguments: SourceOfIndicators: simple: https://www.deepinstinct.com/blog/cve-2023-23397-exploitations-in-the-wild-what-you-need-to-know countTotalIndicators: complex: root: CVE accessor: ID transformers: - operator: append args: item: value: simple: IP.Address iscontext: true - operator: uniq - operator: count playbookDescription: complex: root: inputs.PlaybookDescription separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 450, "y": 940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: ca9cf476-fca8-4acb-86e9-ab0121f68cc5 type: condition task: id: ca9cf476-fca8-4acb-86e9-ab0121f68cc5 version: -1 name: Is Elasticsearch Enabled? description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned. type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "Yes": - "19" separatecontext: false conditions: - label: "Yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: containsGeneral left: value: simple: modules.brand iscontext: true right: value: simple: Elasticsearch ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 2260, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: b6ec351d-ed28-4871-8494-61059e65fb4b type: condition task: id: b6ec351d-ed28-4871-8494-61059e65fb4b version: -1 name: Is Azure Log Analytics Enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "yes": - "15" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Azure Log Analytics ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true iscontext: true continueonerrortype: "" view: |- { "position": { "x": 940, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 7263efc3-44ff-4615-8714-72d26b664a30 type: regular task: id: 7263efc3-44ff-4615-8714-72d26b664a30 version: -1 name: Outlook initiating connection to WebDAV or SMB share description: |- Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation, based on the following Sigma rule: [CVE-2023-23397 Exploitation Attempt](https://github.com/SigmaHQ/sigma/blob/b52abdef5c2929933dbaee5ae5a2edd1be0981c5/rules/windows/builtin/security/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml) script: '|||azure-log-analytics-execute-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "40" scriptarguments: query: simple: SecurityEvent | where ((EventID == 4656 or EventID == 4663) and ProcessName endswith @'\OUTLOOK.EXE' and Accesses contains 'Query key value' and ObjectName contains @'\REGISTRY\MACHINE\SYSTEM' and ObjectName contains @'Services\' and (ObjectName endswith @'WebClient\NetworkProvider' or ObjectName endswith @'LanmanWorkstation\NetworkProvider')) separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 940, "y": 2260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 758ee825-a395-49f3-8931-d9cfd7a7fef8 type: regular task: id: 758ee825-a395-49f3-8931-d9cfd7a7fef8 version: -1 name: Outlook initiating connection to WebDAV or SMB share description: |- Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation, based on the following Sigma rule: [CVE-2023-23397 Exploitation Attempt](https://github.com/SigmaHQ/sigma/blob/b52abdef5c2929933dbaee5ae5a2edd1be0981c5/rules/windows/builtin/security/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml) script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "40" scriptarguments: query: simple: source="WinEventLog:Security" AND ((EventCode="4656" OR EventCode="4663") AND ProcessName="*\\OUTLOOK.EXE" AND Accesses="*Query key value*" AND ObjectName="*\\REGISTRY\\MACHINE\\SYSTEM*" AND ObjectName="*Services\\*" AND (ObjectName="*WebClient\\NetworkProvider" OR ObjectName="*LanmanWorkstation\\NetworkProvider")) separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1820, "y": 2260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 91462db8-0dd2-4fe5-8cd1-dd9232068bdf type: regular task: id: 91462db8-0dd2-4fe5-8cd1-dd9232068bdf version: -1 name: Outlook initiating connection to WebDAV or SMB share description: |- Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation, based on the following Sigma rule: [CVE-2023-23397 Exploitation Attempt](https://github.com/SigmaHQ/sigma/blob/b52abdef5c2929933dbaee5ae5a2edd1be0981c5/rules/windows/builtin/security/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml) script: Elasticsearch v2|||es-eql-search type: regular iscommand: true brand: Elasticsearch v2 nexttasks: '#none#': - "40" scriptarguments: query: simple: (winlog.channel:"Security" AND winlog.event_id:("4656" OR "4663") AND winlog.event_data.ProcessName:*\\OUTLOOK.EXE AND Accesses:*Query\ key\ value* AND winlog.event_data.ObjectName:*\\REGISTRY\\MACHINE\\SYSTEM* AND winlog.event_data.ObjectName:*Services\\* AND winlog.event_data.ObjectName:(*WebClient\\NetworkProvider OR *LanmanWorkstation\\NetworkProvider)) separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2260, "y": 2260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 0a9d4c6b-0ab3-4943-803d-71b29d3b0e07 type: regular task: id: 0a9d4c6b-0ab3-4943-803d-71b29d3b0e07 version: -1 name: Collect IoCs from DeepInstinct description: This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions. scriptName: ParseHTMLIndicators type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: url: simple: https://www.deepinstinct.com/blog/cve-2023-23397-exploitations-in-the-wild-what-you-need-to-know reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 10cb142b-1fe1-48e7-8623-786730a9751a type: title task: id: 10cb142b-1fe1-48e7-8623-786730a9751a version: -1 name: Download IR Tools type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 26abc62b-b777-4bba-880c-18999fa2941d type: regular task: id: 26abc62b-b777-4bba-880c-18999fa2941d version: -1 name: Tag IP Indicators description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue. scriptName: CreateNewIndicatorsOnly type: regular iscommand: false brand: "" nexttasks: '#none#': - "11" scriptarguments: indicator_values: complex: root: IP accessor: Address tags: simple: Outlook, 0-day, Microsoft, CVE-2023-23397 type: simple: IP reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 880, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 53187120-3a2e-4cbf-84e2-e780714a2926 type: playbook task: id: 53187120-3a2e-4cbf-84e2-e780714a2926 version: -1 name: Outlook initiating connection to WebDAV or SMB share description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" nexttasks: '#none#': - "40" scriptarguments: interval: simple: "1" query_expression: simple: SELECT UTF8(payload) from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and ("EventID" = '4656' or "EventID" = '4663') and UTF8(payload) ILIKE '%\OUTLOOK.EXE' and UTF8(payload) ILIKE '%Query key value%' and "ObjectName" ilike '%\REGISTRY\MACHINE\SYSTEM%' and "ObjectName" ilike '%Services\%' and ("ObjectName" ilike '%WebClient\NetworkProvider' or "ObjectName" ilike '%LanmanWorkstation\NetworkProvider') timeout: simple: "600" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1380, "y": 2260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 8b035c8c-4c40-4625-840f-c9c639dc3b23 type: title task: id: 8b035c8c-4c40-4625-840f-c9c639dc3b23 version: -1 name: PowerShell Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "25" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: f8d15b87-c50d-4e63-8825-c4a0fcdb1a15 type: regular task: id: f8d15b87-c50d-4e63-8825-c4a0fcdb1a15 version: -1 name: Run CVE-2023-23397 hunting script description: |- Please refer to the Microsoft release notes for the full steps needed for the script execution. [CVE-2023-23397 PowerShell Hunting Script](https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/) The file is ready to be used in the incident War Room, you can also find it by filtering for '**huntingScript**' tag. File name: CVE-2023-23397.ps1 type: regular iscommand: false brand: "" nexttasks: '#none#': - "26" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: b474e40e-7ac7-425a-8959-fb22bdec0a67 type: collection task: id: b474e40e-7ac7-425a-8959-fb22bdec0a67 version: -1 name: Verify PowerShell hunting script results description: Check Microsoft PowerShell script execution results for further investigation. type: collection iscommand: false brand: "" nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1550 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Verify PowerShell hunting script results methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Found any suspicious email files? required: true gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - {} - simple: "Yes" - simple: "No" fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Verify PowerShell hunting script results description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 77c7bfcc-db7d-4e3e-8bd7-62cf46be9871 type: condition task: id: 77c7bfcc-db7d-4e3e-8bd7-62cf46be9871 version: -1 name: Found suspicious email files? description: User input for whether results were found in the script execution. type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "yes": - "28" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: Verify PowerShell hunting script results.Answers accessor: "0" iscontext: true right: value: simple: "yes" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 65715187-5b3e-4d58-8a66-85b9b72e54f7 type: condition task: id: 65715187-5b3e-4d58-8a66-85b9b72e54f7 version: -1 name: Upload email files for analysis? description: Asks the user for the eml files for further analysis. type: condition iscommand: false brand: "" nexttasks: Manual: - "41" "Yes": - "30" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -210, "y": 1890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: e771792b-2a37-482a-8e6d-f5e5c967eb14 type: playbook task: id: e771792b-2a37-482a-8e6d-f5e5c967eb14 version: -1 name: Process Email - Generic v2 description: | This playbook adds email details to the relevant context entities and handles original email attachments. The v2 playbook enables parsing email artifacts more efficiently, including: - Using incident fields and not incident labels. - Providing separate paths to "Phishing Alerts". - Using the new "Get Original Email - Generic v2" playbook to retrieve original emails as EML files from the following integrations: * EWS v2 * Microsoft Graph Mail integration * Gmail * FireEye EX and FireEye CM * Proofpoint Protection Server * Agari Phishing Defense (EWS v2, MSGraph Mail, Gmail) * Mimecast playbookName: Process Email - Generic v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "40" scriptarguments: Email: complex: root: incident accessor: emailto EmailCC: complex: root: incident accessor: emailcc EmailFileToExtract: simple: Inner file EmailFormat: complex: root: incident accessor: emailformat EmailFrom: complex: root: incident accessor: emailfrom EmailHeaders: complex: root: incident accessor: phishingreporteremailheaders EmailHtml: complex: root: incident accessor: emailhtml EmailSubject: complex: root: incident accessor: emailsubject EmailText: complex: root: incident accessor: emailbody File: complex: root: File filters: - - operator: isEqualString left: value: simple: File.Extension iscontext: true right: value: simple: eml ignorecase: true GetOriginalEmail: simple: "False" MessageID: complex: root: incident accessor: emailmessageid Thread-Topic: complex: root: incident accessor: emailsubject UserID: complex: root: incident accessor: emailto transformers: - operator: replaceMatch args: regex: value: simple: (?i).*<([A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,})> replaceWith: value: simple: $1 separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 forEach: true view: |- { "position": { "x": -210, "y": 2250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: cb8484a1-06fd-4860-839b-c0a21a9672b1 type: collection task: id: cb8484a1-06fd-4860-839b-c0a21a9672b1 version: -1 name: Upload suspicious emails for processing description: Upload the eml files. type: collection iscommand: false brand: "" nexttasks: '#none#': - "29" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -210, "y": 2070 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Upload suspicious emails for processing methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: required: false gridcolumns: [] defaultrows: [] type: attachments options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Please upload the suspicious email files description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 0f8f299e-2c4f-43ab-8122-d7d6490c2e68 type: playbook task: id: 0f8f299e-2c4f-43ab-8122-d7d6490c2e68 version: -1 name: Threat Hunting - Generic description: "This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: \n- Splunk\n- Qradar\n- Pan-os \n- Cortex data lake \n- Autofocus\n- Microsoft 365 Defender" playbookName: Threat Hunting - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "35" scriptarguments: IPAddress: complex: root: IP accessor: Address transformers: - operator: uniq QRadarTimeFrame: complex: root: inputs.QRadarTimeRange SplunkEarliestTime: complex: root: inputs.SplunkEarliestTime SplunkLatestTime: complex: root: inputs.SplunkLatestTime URLDomain: complex: root: Domain accessor: Name transformers: - operator: append args: item: value: simple: URL.Data iscontext: true - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 450, "y": 2560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: fb084266-fb76-43f1-85d9-de961a358800 type: title task: id: fb084266-fb76-43f1-85d9-de961a358800 version: -1 name: Resolution description: Whether to continue with the investigation or close it. type: title iscommand: false brand: "" nexttasks: '#none#': - "51" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 3d691553-ee28-4127-869e-d36dbdf4d365 type: condition task: id: 3d691553-ee28-4127-869e-d36dbdf4d365 version: -1 name: Should block indicators automatically? description: Checks whether to block the indicators automatically. type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "yes": - "36" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.autoBlockIndicators iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 450, "y": 2720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 8adb76c2-29d7-4a2c-8265-3b3eead1988b type: playbook task: id: 8adb76c2-29d7-4a2c-8265-3b3eead1988b version: -1 name: Block Indicators - Generic v3 playbookName: Block Indicators - Generic v3 type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "42" separatecontext: true continueonerrortype: "" view: |- { "position": { "x": 670, "y": 2890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: fcfdfc90-159d-4a63-80fe-f87316d608c8 type: regular task: id: fcfdfc90-159d-4a63-80fe-f87316d608c8 version: -1 name: Handle indicators manually description: Manual task for indicators handling. type: regular iscommand: false brand: "" nexttasks: '#none#': - "42" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 230, "y": 2890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: 9058a036-0cd6-4185-83a7-8b4464b8b6b8 type: regular task: id: 9058a036-0cd6-4185-83a7-8b4464b8b6b8 version: -1 name: Investigate further description: Continue with the investigation manually. type: regular iscommand: false brand: "" nexttasks: '#none#': - "39" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 3720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: 88fa96b1-04e6-43f9-8e4c-6ab3c892175b type: title task: id: 88fa96b1-04e6-43f9-8e4c-6ab3c892175b version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: 2d1c588a-fac4-481a-851c-f23e25c82f96 type: title task: id: 2d1c588a-fac4-481a-851c-f23e25c82f96 version: -1 name: Indicators Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "32" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 2430 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 1d92b965-f609-4d3b-8e53-f1f706a70eef type: regular task: id: 1d92b965-f609-4d3b-8e53-f1f706a70eef version: -1 name: Review found email files manually description: Manual review of the found suspicious email files. type: regular iscommand: false brand: "" nexttasks: '#none#': - "40" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 210, "y": 2250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 6ab754aa-b745-44cc-804d-98ad2e5ac9ae type: title task: id: 6ab754aa-b745-44cc-804d-98ad2e5ac9ae version: -1 name: Mitigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" - "44" - "47" - "62" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3060 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 24502910-de52-498a-8d2e-b9b4b872ffea type: regular task: id: 24502910-de52-498a-8d2e-b9b4b872ffea version: -1 name: Microsoft mitigating factors description: "#### Protected Users Security Group\n\nAdd users to the Protected Users Security Group, which prevents the use of NTLM as an authentication mechanism.\nPerforming this mitigation makes troubleshooting easier than other methods of disabling NTLM. Consider using it for high value accounts such as Domain Admins when possible. Please note: \nThis may cause impact to applications that require NTLM, however the settings will revert once the user is removed from the Protected Users Group. \n\n#### Block TCP 445/SMB\n\nBlock TCP 445/SMB outbound from your network by using a perimeter firewall, a local firewall, and via your VPN settings. This will prevent the sending of NTLM authentication messages to remote file shares.\n" type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 230, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: c2febb6b-03fc-47b1-8629-8be6e2f9ea5e type: regular task: id: c2febb6b-03fc-47b1-8629-8be6e2f9ea5e version: -1 name: Patch vulnerable servers description: |- Download Microsoft's latest security updates and patch all vulnerable servers. [Microsoft Outlook Elevation of Privilege Vulnerability ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397) type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 670, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: e33c3871-8a14-47bc-8922-592c99eb9159 type: title task: id: e33c3871-8a14-47bc-8922-592c99eb9159 version: -1 name: Download Signatures type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "46" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 10, "y": 180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: bd7708ca-96ac-46b8-8b2b-992ea353e85a type: regular task: id: bd7708ca-96ac-46b8-8b2b-992ea353e85a version: -1 name: Download Yara Rules description: |- This file contains multiple Yara rules provided by Neo23x0. Reference: [expl_outlook_cve_2023_23397.yar](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2023_23397.yar) tags: - Yara scriptName: HttpV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: filename: simple: expl_outlook_cve_2023_23397.yar method: simple: GET save_as_file: simple: "yes" unsecure: simple: "True" url: simple: https://raw.githubusercontent.com/Neo23x0/signature-base/master/yara/expl_outlook_cve_2023_23397.yar separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 10, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: f413179b-6a97-4b55-8106-0965c695d4de type: regular task: id: f413179b-6a97-4b55-8106-0965c695d4de version: -1 name: Deploy Yara rules description: | The Yara rules file is ready to be used in the incident War Room, you can also find it by filtering for '**Yara**' tag. File name: expl_outlook_cve_2023_23397.yar type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -210, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: 07bad16d-38de-4090-89bb-ef956027b5fe type: title task: id: 07bad16d-38de-4090-89bb-ef956027b5fe version: -1 name: Cortex XDR type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "57" - "58" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -910, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "49": id: "49" taskid: e12b643b-41dd-4798-8c65-228c46954667 type: regular task: id: e12b643b-41dd-4798-8c65-228c46954667 version: -1 name: Suspicious WebDAV request to an external destination description: | #### Looks for svchost initiating a rundll32 WebDAV request to an external destination Source: https://twitter.com/ACEResponder/status/1636116096506818562/photo/1 Reference: https://www.n00py.io/2019/06/understanding-unc-paths-smb-and-webdav/ script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "40" scriptarguments: query: simple: |- dataset = xdr_data | filter actor_process_image_name = "rundll32.exe" | filter actor_process_command_line contains "DavSetCookie" | filter actor_process_command_line contains "http:" | filter actor_process_command_line contains "@80" or actor_process_command_line contains "@SSL" or actor_process_command_line contains "@443" query_name: simple: svchost initiating a rundll32 webdav request to an external destination time_frame: complex: root: inputs.XQLTimeRange separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -840, "y": 2250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: e48aa101-a1c1-4374-8375-79dbaff93bcf type: condition task: id: e48aa101-a1c1-4374-8375-79dbaff93bcf version: -1 name: Is Cortex XDR XQL Query Engine Enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "yes": - "49" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Cortex XDR - XQL Query Engine ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": -630, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: 25f2cec8-2461-44be-87b1-03b48b68242d type: condition task: id: 25f2cec8-2461-44be-87b1-03b48b68242d version: -1 name: Should continue with the investigation? description: Whether to continue with the investigation or close it. type: condition iscommand: false brand: "" nexttasks: '#default#': - "39" "Yes": - "38" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "52": id: "52" taskid: f461f437-c82b-4f85-8879-4d15921c45e2 type: title task: id: f461f437-c82b-4f85-8879-4d15921c45e2 version: -1 name: IPS Signatures type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "53" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1810, "y": 1905 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: 15447708-b337-4406-8383-6aebfad745fc type: playbook task: id: 15447708-b337-4406-8383-6aebfad745fc version: -1 name: Panorama Query Logs playbookName: Panorama Query Logs type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "40" scriptarguments: log_type: simple: threat query: simple: (threatid eq 93584) or (threatid eq 1110542) separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -1810, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: f8f5e156-2dfe-4b2c-8ea6-78890edceee8 type: playbook task: id: f8f5e156-2dfe-4b2c-8ea6-78890edceee8 version: -1 name: Search Endpoint by CVE - Generic playbookName: Search Endpoint by CVE - Generic type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "40" scriptarguments: CVE_ID: complex: root: CVE accessor: ID separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 2760, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: 51bcface-7da2-4e14-8d7f-b45539027380 type: title task: id: 51bcface-7da2-4e14-8d7f-b45539027380 version: -1 name: Endpoints by CVE Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "54" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2760, "y": 1890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 01eb5e4c-e1e3-478d-8c4c-27badc00c574 type: title task: id: 01eb5e4c-e1e3-478d-8c4c-27badc00c574 version: -1 name: XQL Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "50" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -630, "y": 1755 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: 2e11591a-0354-461a-8233-9ea519923ac6 type: title task: id: 2e11591a-0354-461a-8233-9ea519923ac6 version: -1 name: BTP Hunting description: "Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value." type: title iscommand: false brand: "" nexttasks: '#none#': - "59" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1210, "y": 1755 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: f7d8d3f9-6ca1-4fd9-8d06-e9fdc9f3b572 type: regular task: id: f7d8d3f9-6ca1-4fd9-8d06-e9fdc9f3b572 version: -1 name: Search CVE-2023-23397 alerts description: "Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value." script: '|||xdr-get-alerts' type: regular iscommand: true brand: "" nexttasks: '#none#': - "60" scriptarguments: custom_filter: simple: |- { "AND": [ { "SEARCH_FIELD": "alert_description", "SEARCH_TYPE": "CONTAINS", "SEARCH_VALUE": "CVE-2023-23397" } ] } separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1210, "y": 1890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: 4aff4c4c-66cc-47f8-84ad-d21edd71c8e7 type: condition task: id: 4aff4c4c-66cc-47f8-84ad-d21edd71c8e7 version: -1 name: Found relevant alerts? description: Checks if alerts were found type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "yes": - "61" separatecontext: false conditions: - label: "yes" condition: - - operator: containsGeneral left: value: complex: root: PaloAltoNetworksXDR.Alert accessor: alert_description iscontext: true right: value: simple: CVE-2023-23397 continueonerrortype: "" view: |- { "position": { "x": -1210, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: 697bcc4e-2341-4e37-824c-170b9c90ec7c type: regular task: id: 697bcc4e-2341-4e37-824c-170b9c90ec7c version: -1 name: Respond to exploitation attempts caught by Cortex XDR description: Manual response for identified Cortex XDR alerts type: regular iscommand: false brand: "" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1380, "y": 2250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: 329e5fbc-f706-41a2-836a-a21fdeeff2cc type: regular task: id: 329e5fbc-f706-41a2-836a-a21fdeeff2cc version: -1 name: Cortex XDR Advanced API Monitoring description: |- To ensure you receive alerts and monitor exploitation attempts: 1. Verify that you are using Cortex XDR agent version 8.0 and above. 2. Verify that your agent is updated to content version 910-49200. 3. Enable ‘Advanced API Monitoring’ in the Malware Profile. Go to Policy Management > 4. Profiles > Malware Profile > Global Behavioral Threat Protection Rules >Advanced API Monitoring and select - Report. 5. Restart your running outlook applications to ensure full coverage. type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1110, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "13_19_Yes": 0.4, "13_40_#default#": 0.1, "14_15_yes": 0.4, "14_40_#default#": 0.29, "27_28_yes": 0.73, "27_40_#default#": 0.2, "28_30_Yes": 0.43, "28_41_Manual": 0.5, "35_36_yes": 0.41, "50_40_#default#": 0.15, "50_49_yes": 0.25, "51_39_#default#": 0.49, "60_40_#default#": 0.11, "60_61_yes": 0.28, "8_17_Yes": 0.42, "8_40_#default#": 0.12, "9_23_Yes": 0.4, "9_40_#default#": 0.17 }, "paper": { "dimensions": { "height": 3915, "width": 4950, "x": -1810, "y": 40 } } } inputs: - key: PlaybookDescription value: simple: "### CVE-2023-23397 - Critical Elevation of Privilege vulnerability in Microsoft Outlook \n\n#### Summary \nMicrosoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure.\n\n#### Affected Products \nAll supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected.\n\n#### Technical Details \nCVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required.\n\nThe threat actor is using a connection to the remote SMB server sends the user’s NTLM negotiation message, which the attacker can then relay for authentication against other systems that support NTLM authentication.\n\n**This playbook should be triggered manually or can be configured as a job.** \nPlease create a new incident and choose the CVE-2023-23397 - Microsoft Outlook EoP playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**Hunting:**\n- Panorama Threat IDs\n- Cortex XDR\n - XQL hunting query\n - BTP hunting\n- Microsoft PowerShell hunting script\n- Advanced SIEM hunting queries\n- Indicators hunting\n- Endpoint by CVE hunting\n\n**Mitigations:**\n- Cortex XDR Advanced API Monitoring \n- Microsoft official CVE-2023-23397 patch\n- Microsoft workarounds\n- Detection Rules\n - Yara\n\n**References:**\n\n[Microsoft Mitigates Outlook Elevation of Privilege Vulnerability](https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/)\n\n[CVE-2023-23397 Audit & Eradication Script](https://github.com/microsoft/CSS-Exchange/blob/a4c096e8b6e6eddeba2f42910f165681ed64adf7/docs/Security/CVE-2023-23397.md)\n\n[Neo23x0 Yara Rules](https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2023_23397.yar)\n\nNote: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve." required: false description: The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook. playbookInputQuery: - key: autoBlockIndicators value: simple: "False" required: false description: Whether to block the indicators automatically. playbookInputQuery: - key: QRadarTimeRange value: simple: LAST 7 DAYS required: false description: The time range to search for indicators in the Threat Hunting - Generic playbook. playbookInputQuery: - key: SplunkEarliestTime value: simple: -7d@d required: false description: The earliest time to search for indicators in the Threat Hunting - Generic playbook. playbookInputQuery: - key: SplunkLatestTime value: simple: now required: false description: The latest time to search for indicators in the Threat Hunting - Generic playbook. playbookInputQuery: - key: XQLTimeRange value: simple: 7 days ago required: false description: The time range for the Cortex XDR XQL query. playbookInputQuery: outputs: [] tests: - No tests (auto formatted) fromversion: 6.8.0