Microsoft Patches Exploited Outlook, SmartScreen Flaws
Microsoft's March 2023 patches fix two actively exploited vulnerabilities, CVE-2023-23397 in Outlook and CVE-2023-24880 in Windows SmartScreen, IPA warns users to patch immediately.
Japan's IPA issued an alert on March 15, 2023 regarding Microsoft's monthly security update, highlighting that two of the patched vulnerabilities are confirmed by Microsoft to be actively exploited in the wild. CVE-2023-23397 is a critical Outlook elevation-of-privilege vulnerability that can be triggered without user interaction, allowing attackers to leak NTLM credentials via a crafted email. CVE-2023-24880 is a Windows SmartScreen security-feature-bypass vulnerability that has reportedly been used to help deliver Magniber ransomware by evading Mark-of-the-Web protections.
IPA urges organizations and individuals to apply the Microsoft patches immediately given the confirmed in-the-wild exploitation and the potential for expanded attacks. The advisory is a general awareness notice rather than a detailed technical writeup, directing readers to Windows Update and vendor resources for remediation guidance.
Mentioned in this report
Detection guidance
Outlook Process Initiating Outbound SMB Connection (Potential CVE-2023-23397 NTLM Leak)
Detects OUTLOOK.EXE establishing an outbound SMB/WebDAV connection (port 445 or 80/443 to non-Microsoft infrastructure), consistent with the CVE-2023-23397 reminder-sound UNC path exploit used to coerce NTLM authentication to an attacker-controlled host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outlook Process Initiating Outbound SMB Connection
id: 3d0de957-3ee5-52f5-b4d7-07ae1e82fdfc
status: experimental
description: 'Detects OUTLOOK.EXE initiating an outbound network connection to TCP
port 445 (SMB), which is the mechanism
abused by CVE-2023-23397 to coerce NTLM authentication from an Outlook client to
an attacker-controlled server
via a crafted reminder sound/UNC path property in a malicious email or calendar
item. Outlook normally has no
legitimate reason to open outbound SMB connections to arbitrary external hosts.
'
references:
- https://www.ipa.go.jp
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \OUTLOOK.EXE
DestinationPort: 445
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_internal
falsepositives:
- Legitimate access to internal file shares referenced from signatures or embedded
links (should resolve to internal IP ranges)
- VPN-connected clients where corporate SMB shares are reachable over routable private
ranges not covered by the filter
level: high
tags:
- attack.t1187
- attack.credential_access
- cve.2023.23397
author: Vorant
MSI Installer Executed Directly From User Download or Temp Path Without Explorer Parent
Detects msiexec.exe launched with an install path under a user Downloads/Temp/browser cache folder without explorer.exe as the parent process, a pattern consistent with SmartScreen Mark-of-the-Web bypass abuse (CVE-2023-24880) used to deliver Magniber ransomware payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious MSI Execution From User Download Path Bypassing Explorer
id: c699eb9f-9a28-59f4-a44d-d27966a18e1a
status: experimental
description: 'Detects msiexec.exe installing a package located in a user''s Downloads,
Temp, or browser cache directory
where the parent process is not explorer.exe. This deviates from the normal user
double-click launch flow
and is consistent with reports of CVE-2023-24880, a Windows SmartScreen bypass that
let attacker-signed MSI
files evade the Mark-of-the-Web security prompt to deliver Magniber ransomware.
'
references:
- https://www.ipa.go.jp
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \msiexec.exe
CommandLine|contains:
- \Downloads\\
- \AppData\Local\Temp\\
- \Temporary Internet Files\\
filter_explorer_parent:
ParentImage|endswith: \explorer.exe
condition: selection and not filter_explorer_parent
falsepositives:
- Legitimate software installers self-invoking msiexec from a bundled installer or
update mechanism located in a temp folder
- IT deployment tools or scripts that call msiexec directly from a staged download
location
level: medium
tags:
- attack.t1553.005
- attack.defense_evasion
- cve.2023.24880
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20230315-ms.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free