Microsoft recently released patches for nearly 80 new security vulnerabilities, including two zero-day exploits, CVE-2023-23397 and CVE-2023-24880. CVE-2023-23397 is an elevation-of-privilege (EoP) vulnerability in Microsoft Outlook that could allow an attacker to obtain a victim’s password hash. The vulnerability occurs when an attacker sends a message to the victim with an extended Message Application Program Interface (MAPI) property that contains a Universal Naming Convention (UNC) path. When the victim receives the malicious message, the UNC path directs them to a Server Message Block (SMB) (TCP 445) share hosted on a server controlled by the attacker, triggering the vulnerability.
This vulnerability doesn't require any action from the user, and when the victim connects to the attacker’s SMB server, their New Technology LAN Manager (NTLM) negotiation message is sent automatically, which the attacker can use for authentication against other systems that support NTLM authentication. However, online services like Microsoft 365 are not susceptible to this attack since they don't support NTLM authentication.
Although Microsoft has published a detailed advisory for CVE-2023-23397, detecting successful exploitation of the vulnerability can be challenging. Cyborg Security has seen numerous instances online of advisories stating that security teams should look for the Outlook.exe process initiating SMB communications. However, Cyborg Security has found that the underlying operating system (SYSTEM) is actually initiating the SMB connection, not the Outlook.exe process. To detect the vulnerability reliably, security teams should look for SYSTEM establishing SMB and LDAP connections to non-private networks.
This vulnerability affects all currently supported versions of Microsoft Outlook for Windows, but not Outlook for Android, iOS, or macOS. If patching is not immediately possible, Microsoft recommends adding users to the Protected Users group in Active Directory and blocking outbound SMB traffic on TCP port 445.
According to Microsoft, cybercriminals linked to Russian intelligence services have actively exploited this zero-day vulnerability. The threat actors (TAs) have used the exploit to target government, military, energy, and transportation organizations in the past year. CVE-2023-23397 allows a threat actor to send a specially crafted email with a malicious payload that causes the victim’s Outlook client to automatically connect to a UNC location under the actor’s control to receive the Net-NTLMv2 user’s password hash. This disclosure of credentials would permit further methods of exploitation, and exploitation can occur prior to the email being opened or previewed by the user.
To prevent potential attacks, Microsoft recommends that users patch their systems immediately. The company has also released several mitigations for organizations that cannot patch their systems immediately. It's important for users and organizations to stay vigilant and keep their systems updated to protect themselves against potential cyber attacks.
Cyborg Security has released premium detection content for our customers to hunt for this exploit and its associated behavior.
Initial access brokers sell information about or access to compromised computers. Here's how to threat hunt for a known attack behavior involving PowerShell that's used by a prolific initial access broker.
In July 2025 threat actors exploited zero-day vulnerabilities in on-premises Microsoft SharePoint servers in an incident known as ToolShell. In this case study, we conduct a threat hunt for ToolShell-related activity.
Guided Threat Hunts offers a library of Pivot Queries for hundreds of hunt packages that enable your threat hunters and analysts to overcome uncertainty and boost productivity. Guided Threat Hunts is a set of packages that assists users modify their result set to decide their next step and filter out noise from extraneous results.
Stay informed with our weekly executive update, sending you the latest news and timely data on the threats, risks, and regulations affecting your organization.