CVE-2023-23397 | Netskope Threat Labs

Description

This detection identifies exploitation attempts targeting CVE-2023-23397, which has a CRITICAL severity rating. Microsoft's advisory names this issue the Microsoft Outlook Elevation of Privilege Vulnerability, which lets a cyberattacker trigger outbound connections that leak NTLM credential hashes to cyberattacker controlled servers, often without any user interaction.

Stats

First seen: March 2023
Last seen: October 2026

CVEs

CVE-2023-23397

Alert name variants

Alert Name	Engine
Document-Office.Exploit.CVE-2023-23397	ATP Sandbox Adv. Heuristics
Email-MIME.Exploit.CVE-2023-23397	ATP Sandbox Adv. Heuristics
Email-MSG.Exploit.CVE-2023-23397	ATP Sandbox Adv. Heuristics
Email.Exploit.CVE-2023-23397	ATP Sandbox Adv. Heuristics
Exploit.CVE-2023-23397.1.Gen	ATP Sandbox Adv. HeuristicsAV
Exploit.CVE-2023-23397.2.Gen	AV
Exploit.CVE-2023-23397.3.Gen	AV
Exploit.CVE-2023-23397.A	AV
Win32.Exploit.CVE-2023-23397	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
FILE-OFFICE Microsoft Office Outlook appointment privilege escalation attempt	IPS-SWG

Related blogs

Threat Labs News Roundup: March 2023

April 10, 20234 min read

CVE-2023-23397: Microsoft Outlook Zero-Day Exploited by APT28

March 21, 20231 min read

Related families

Microsoft

References

nvd.nist.gov