Microsoft Patches Exploited Outlook, SmartScreen Flaws
Microsoft's March 2023 patches fix two actively exploited vulnerabilities, CVE-2023-23397 in Outlook and CVE-2023-24880 in Windows SmartScreen, IPA warns users to patch immediately.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-23397 and CVE-2023-24880 as exploited in the wild.
Japan's IPA issued an alert on March 15, 2023 regarding Microsoft's monthly security update, highlighting that two of the patched vulnerabilities are confirmed by Microsoft to be actively exploited in the wild. CVE-2023-23397 is a critical Outlook elevation-of-privilege vulnerability that can be triggered without user interaction, allowing attackers to leak NTLM credentials via a crafted email. CVE-2023-24880 is a Windows SmartScreen security-feature-bypass vulnerability that has reportedly been used to help deliver Magniber ransomware by evading Mark-of-the-Web protections.
IPA urges organizations and individuals to apply the Microsoft patches immediately given the confirmed in-the-wild exploitation and the potential for expanded attacks. The advisory is a general awareness notice rather than a detailed technical writeup, directing readers to Windows Update and vendor resources for remediation guidance.
Mentioned in this report
Detection guidance
Outlook Process Initiating Outbound SMB Connection (Potential CVE-2023-23397 NTLM Leak)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects OUTLOOK.EXE establishing an outbound SMB/WebDAV connection (port 445 or 80/443 to non-Microsoft infrastructure), consistent with the CVE-2023-23397 reminder-sound UNC path exploit used to coerce NTLM authentication to an attacker-controlled host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outlook Process Initiating Outbound SMB Connection
id: 3d0de957-3ee5-52f5-b4d7-07ae1e82fdfc
status: experimental
description: 'Detects OUTLOOK.EXE initiating an outbound network connection to TCP
port 445 (SMB), which is the mechanism
abused by CVE-2023-23397 to coerce NTLM authentication from an Outlook client to
an attacker-controlled server
via a crafted reminder sound/UNC path property in a malicious email or calendar
item. Outlook normally has no
legitimate reason to open outbound SMB connections to arbitrary external hosts.
'
references:
- https://www.ipa.go.jp
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \OUTLOOK.EXE
DestinationPort: 445
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_internal
falsepositives:
- Legitimate access to internal file shares referenced from signatures or embedded
links (should resolve to internal IP ranges)
- VPN-connected clients where corporate SMB shares are reachable over routable private
ranges not covered by the filter
level: high
tags:
- attack.t1187
- attack.credential-access
- cve.2023.23397
author: Vorant
MSI Installer Executed Directly From User Download or Temp Path Without Explorer Parent
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects msiexec.exe launched with an install path under a user Downloads/Temp/browser cache folder without explorer.exe as the parent process, a pattern consistent with SmartScreen Mark-of-the-Web bypass abuse (CVE-2023-24880) used to deliver Magniber ransomware payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious MSI Execution From User Download Path Bypassing Explorer
id: c699eb9f-9a28-59f4-a44d-d27966a18e1a
status: experimental
description: 'Detects msiexec.exe installing a package located in a user''s Downloads,
Temp, or browser cache directory
where the parent process is not explorer.exe. This deviates from the normal user
double-click launch flow
and is consistent with reports of CVE-2023-24880, a Windows SmartScreen bypass that
let attacker-signed MSI
files evade the Mark-of-the-Web security prompt to deliver Magniber ransomware.
'
references:
- https://www.ipa.go.jp
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \msiexec.exe
CommandLine|contains:
- \Downloads\\
- \AppData\Local\Temp\\
- \Temporary Internet Files\\
filter_explorer_parent:
ParentImage|endswith: \explorer.exe
condition: selection and not filter_explorer_parent
falsepositives:
- Legitimate software installers self-invoking msiexec from a bundled installer or
update mechanism located in a temp folder
- IT deployment tools or scripts that call msiexec directly from a staged download
location
level: medium
tags:
- attack.t1553.005
- attack.defense-impairment
- cve.2023.24880
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20230315-ms.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs