Menu

YARA · Frank Boldewin (R3c0nst)

R3C0NST_Exploit_Outlook_CVE_2023_23397

Detects Outlook appointments exploiting CVE-2023-23397

ExploitFrank Boldewin (R3c0nst)No licence (all rights reserved)Compiles with YARA-X

Author: Frank Boldewin
Date: 2023-03-19
Modified: 2023-03-25
Score / Quality: 75 / 86

What this rule detects

Detects Outlook appointments exploiting CVE-2023-23397

Targets: OLE / legacy Office.

It defines 10 patterns (8 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Frank Boldewin (R3c0nst), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHub Open the repository

References

https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

078b5023cae7bd784a84ec4ee8df305ee7825025265bf2ddc1f5238c3e432f5f
a034427fd8524fd62380c881c30b9ab483535974ddd567556692cffc206809d1
e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02
1543677037fa339877e1d6ef2d077f94613afbcd6434d7181a18df74aca7742b

Licence & attribution

Author: Frank Boldewin

Source repository: Frank Boldewin (R3c0nst) @ 54e9e6899b

Licence: No licence (all rights reserved) (repository licence)

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7e355e5f-93ca-561d-9a12-f73f1d429e4d

Tags:CVE_2023_23397 FILE