Potential CVE-2023-23397 (Windows Event Log)

id: '16938.27407'
title: Potential CVE-2023-23397
description: 'Microsoft Office Outlook contains a privilege escalation vulnerability
  that allows for a NTLM Relay attack against another service to authenticate as the
  user. This use case looks for svchost spawning rundll with DavSetCookie, which may
  indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28
  (Fancy Bear, Forest Blizzard, STRONTIUM)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "svchost.exe" "rundll32" "davclnt.dll" "DavSetCookie"
  | regex process="(?i)(davclnt.dll.*DavSetCookie.*://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:process injection:dynamic-link library injection
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1048.003
- T1055.001
data_category:
- Windows event logs
references:
- https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
- https://twitter.com/aceresponder/status/1636116096506818562
- https://www.huntress.com/blog/everything-we-know-about-cve-2023-23397?utm_content=241922884&utm_medium=social&utm_source=twitter&hss_channel=tw-3330464153