detection.wiki

Detection rules › Sigma

Outlook Task/Note Reminder Received

Status
test
Severity
low
Log source
product windows, category registry_set
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1137 Office Application Startup

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: Outlook Task/Note Reminder Received
id: fc06e655-d98c-412f-ac76-05c2698b1cb2
status: test
description: Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-05
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.t1137
    - cve.2023-23397
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Office\'
            - '\Outlook\'
        TargetObject|contains:
            - '\Tasks\'
            - '\Notes\'
    condition: selection
falsepositives:
    - Legitimate reminders received for a task or a note will also trigger this rule.
level: low

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetObject|contains|all:
        - '\SOFTWARE\Microsoft\Office\'
        - '\Outlook\'
    TargetObject|contains:
        - '\Tasks\'
        - '\Notes\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectmatch
  • \Notes\
  • \Outlook\
  • \SOFTWARE\Microsoft\Office\ corpus 4 (sigma 4)
  • \Tasks\