Outlook Task/Note Reminder Received

Status: test
Severity: low
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Known false positives

Legitimate reminders received for a task or a note will also trigger this rule.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1137` Office Application Startup

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Outlook Task/Note Reminder Received
id: fc06e655-d98c-412f-ac76-05c2698b1cb2
status: test
description: Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-05
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.t1137
    - cve.2023-23397
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Office\'
            - '\Outlook\'
        TargetObject|contains:
            - '\Tasks\'
            - '\Notes\'
    condition: selection
falsepositives:
    - Legitimate reminders received for a task or a note will also trigger this rule.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|contains|all:
        - '\SOFTWARE\Microsoft\Office\'
        - '\Outlook\'
    TargetObject|contains:
        - '\Tasks\'
        - '\Notes\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	match	`\Notes\` `\Outlook\` `\SOFTWARE\Microsoft\Office\` corpus 4 (sigma 4) `\Tasks\`	`field:"TargetObject" kind:match`