Outlook Task/Note Reminder Received

Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

View on GitHub Open raw file

Detection logic

selection

TargetObject|contains|all:
  - \SOFTWARE\Microsoft\Office\
  - \Outlook\
TargetObject|contains:
  - \Tasks\
  - \Notes\

Condition

selection

Raw YAML

title: Outlook Task/Note Reminder Received
id: fc06e655-d98c-412f-ac76-05c2698b1cb2
status: test
description: Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-05
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.t1137
    - cve.2023-23397
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Office\'
            - '\Outlook\'
        TargetObject|contains:
            - '\Tasks\'
            - '\Notes\'
    condition: selection
falsepositives:
    - Legitimate reminders received for a task or a note will also trigger this rule.
level: low