Microsoft recently disclosed that a Russian-based Advanced Persistent Threat (APT) actor had been exploiting a critical zero-day vulnerability in Outlook since April 2022. The vulnerability, tracked as CVE-2023-23397, leaves few forensic artifacts to discover in traditional endpoint forensic analysis and could be used for initial access, credential access, lateral movement, and persistence in compromised mailboxes. In response, Microsoft has issued guidance for investigating attacks linked to the Outlook flaw, including mitigation guidance and a CVE-2023-23397 detection script to help with audit and cleanup.
Organizations should take proactive steps to defend against this vulnerability by leveraging an in-depth and comprehensive threat hunting strategy. Microsoft recommends reviewing suspicious messages, calendar items, or tasks with reminders reported by users, examining network logging and endpoint logging for evidence of known atomic indicators, scanning Exchange for delivered messages with the PidLidReminderFileParameter set, and hunting for anomalous behaviors such as NTLM authentication involving untrusted or external resources, WebDAV connection attempts, SMBClient event log entries, and outbound SMB connections.
Given the severity of the issue, Microsoft urges organizations to prioritize the deployment of this update. The company has also developed a CVE-2023-23397 detection script to detect any potential exploitation. Organizations should review the output of the script to determine whether the exploit was successful.
In summary, Microsoft recently disclosed that a Russian-based APT actor had been exploiting a critical zero-day vulnerability in Outlook since April 2022. Organizations should take proactive steps to defend against this vulnerability, including leveraging an in-depth and comprehensive threat hunting strategy, examining network logging and endpoint logging, scanning Exchange for delivered messages, and hunting for anomalous behaviors. Microsoft has also provided mitigation guidance and a CVE-2023-23397 detection script to help with audit and cleanup.
Key Points:
- Microsoft has evidence of a Russian APT actor exploiting a critical Outlook zero-day since April 2022.
- Organizations should take proactive steps to defend against this vulnerability by leveraging an in-depth and comprehensive threat hunting strategy.
- Microsoft has released mitigation guidance and a CVE-2023-23397 detection script to help with audit and cleanup.