Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23

Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)

ExploitSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl
Date
2023-03-15
Modified
2023-03-18
Score / Quality
75 / 85

What this rule detects

Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)

It defines 7 patterns (0 text, 7 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
expl-susp-outlook-cve-2023-23397-exfil-ip-mar23.yarDetection Rule License 1.1
rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 : CVE_2023_23397 FILE
{
	meta:
		description = "Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)"
		author = "delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
		id = "d85bf1d9-aebe-5f8c-9dd4-c509f64e221a"
		date = "2023-03-15"
		modified = "2023-03-18"
		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_outlook_cve_2023_23397.yar#L41-L81"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
		hash = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
		logic_hash = "a8e8326f5aaa29b449f9203623e03d3d3a1d176bb764171d860afc510a1732e6"
		score = 75
		quality = 85
		tags = "CVE-2023-23397, FILE"

	strings:
		$psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
		$psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
		$rfp = { 1F 85 00 00 }
		$u1 = { 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 3? 00 3? 00|3? 00 3? 00|3? 00) }
		$u2 = { 00 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 3? 3?|3? 3?|3?) }
		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}

	condition:
		( uint16( 0 ) == 0xCFD0 and 1 of ( $psetid* ) or uint32be( 0 ) == 0x789F3E22 ) and any of ( $u* ) and $rfp and not 1 of ( $fp* )
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$psetid_apphex{ 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
$psetid_meetinghex{ 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
$psetid_taskhex{ 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
$rfphex{ 1F 85 00 00 }
$u1hex{ 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) …
$u2hex{ 00 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 3? 3?|3? 3?|3?) }
$fp_msi1hex{84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}

Condition

( uint16( 0 ) == 0xCFD0 and 1 of ( $psetid* ) or uint32be( 0 ) == 0x789F3E22 ) and any of ( $u* ) and $rfp and not 1 of ( $fp* )

In plain words (Heuristic)

  • At least one pattern in ( $u* ) must match.
  • At least 1 patterns in ( $psetid* ) must match.
  • At least 1 patterns in ( $fp* ) must match.
  • Pattern $rfp must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3
  • 582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf
  • 6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909
  • 7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad
  • eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa
  • e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02

Licence & attribution

Author: delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d85bf1d9-aebe-5f8c-9dd4-c509f64e221a

Tags:CVE_2023_23397FILE