Sigma rule: Potential CVE-2023-23397 Exploitation Attempt - SMB

Rule

Title

Potential CVE-2023-23397 Exploitation Attempt - SMB

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-04-05

Modified

2026-10-19

File

rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Log source

product

windows

service

smbclient-connectivity

Detection

selection:
    # Author Note: You could adapt this rule to use the "ServerName" field and uncomment the commented EventIDs. But you need to provide your own filter for "trusted server names"
    EventID:
        # - 30800 # The server name cannot be resolved. (Doesn't contain the "ServerAddress" field)
        - 30803 # Failed to establish a network connection.
        - 30804 # A network connection was disconnected.
        - 30806 # The client re-established its session to the server.
        # - 31001 # Error (Doesn't contain the "ServerAddress" field)
filter_main_local_ips:
    - RemoteAddress|cidr:
          # IPv4
          - '10.0.0.0/8'
          - '127.0.0.0/8'
          - '169.254.0.0/16'
          - '172.16.0.0/12'
          - '192.168.0.0/16'
          # IPv6
          - '::1/128'  # IPv6 loopback
          - 'fe80::/10'  # IPv6 link-local addresses
          - 'fc00::/7'  # IPv6 private addresses
    - ServerAddress|cidr:
          # IPv4
          - '10.0.0.0/8'
          - '127.0.0.0/8'
          - '169.254.0.0/16'
          - '172.16.0.0/12'
          - '192.168.0.0/16'
          # IPv6
          - '::1/128'  # IPv6 loopback
          - 'fe80::/10'  # IPv6 link-local addresses
          - 'fc00::/7'  # IPv6 private addresses
    - Address|startswith:
    # This is for EventID 30804, which doesn't have the "ServerAddress" field, but a field called "Address" and it contains a socket address (IP:Port) and not an IP
          # IPv4
          - '10.'
          - '127.'
          - '169.254.'
          - '172.'
          - '192.168.'
          # IPv6
          - '::1'
          - 'fe80::'
          - 'fc00::'
    # The filters below cover the XML raw log
    - Address|contains:
          # IPv6
          - '00000000000000000000000000000001' # ::1 - IPv6 loopback
          - 'FE80000000000000' # fe80:: - IPv6 link-local addresses
          - 'FC00000000000000' # fc00:: - IPv6 private addresses
          # IPv4
          # The "?" are meant to represent the port
          - '0200????C0A8' # 192.168.
          - '0200????AC' # 172.
          - '0200????0A' # 10.
          - '0200????7F' # 127
          - '0200????A9FE' # 169.254.
    - ServerAddress|contains:
          # IPv6
          - '00000000000000000000000000000001' # ::1 - IPv6 loopback
          - 'FE80000000000000' # fe80:: - IPv6 link-local addresses
          - 'FC00000000000000' # fc00:: - IPv6 private addresses
          # IPv4
          # The "?" are meant to represent the port
          - '0200????C0A8' # 192.168.
          - '0200????AC' # 172.
          - '0200????0A' # 10.
          - '0200????7F' # 127
          - '0200????A9FE' # 169.254.
    - RemoteAddress|contains:
          # IPv6
          - '00000000000000000000000000000001' # ::1 - IPv6 loopback
          - 'FE80000000000000' # fe80:: - IPv6 link-local addresses
          - 'FC00000000000000' # fc00:: - IPv6 private addresses
          # IPv4
          # The "?" are meant to represent the port
          - '0200????C0A8' # 192.168.
          - '0200????AC' # 172.
          - '0200????0A' # 10.
          - '0200????7F' # 127
          - '0200????A9FE' # 169.254.
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Some false positives may occur from external trusted servers. Apply additional filters accordingly

Tags

• attack.exfiltration
• cve.2023-23397
• detection.emerging-threats

CVEs this rule names

• CVE-2023-23397

References

• https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
• https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml