{"id":126855,"date":"2023-03-24T11:30:00","date_gmt":"2023-03-24T18:30:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=126855"},"modified":"2024-07-03T07:48:16","modified_gmt":"2024-07-03T14:48:16","slug":"guidance-for-investigating-attacks-using-cve-2023-23397","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/24\/guidance-for-investigating-attacks-using-cve-2023-23397\/","title":{"rendered":"Guidance for investigating attacks using CVE-2023-23397"},"content":{"rendered":"\n
\nFebruary 15, 2024 update<\/strong> – On January 20, 2024, the US government conducted a disruption operation against infrastructure used by a threat actor we track as Forest Blizzard (STRONTIUM)<\/a>, a Russian state-sponsored threat actor, as detailed here: https:\/\/www.justice.gov\/opa\/pr\/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian<\/a><\/p>\n<\/blockquote>\n\n\n\n
<\/p>\n\n\n\n
\nDecember 4, 2023 update<\/strong> – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM)<\/a>, based in Russia, actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers. The Polish Cyber Command (DKWOC) partnered with Microsoft to take action against Forest Blizzard actors, and to identify and mitigate techniques used by the actor: https:\/\/www.wojsko-polskie.pl\/woc\/articles\/aktualnosci-w\/detecting-malicious-activity-against-microsoft-exchange-servers\/<\/a>. Users should ensure Microsoft Outlook is patched and kept up to date to mitigate this threat. Microsoft Defender XDR detects the exploitation and known post-compromise activity of CVE-2023-23397. The only updates to the original blog below are in the \u201cWho is Forest Blizzard” section, reflecting our updated attribution, and added links to our product Threat Intelligence reports.<\/p>\n\n\n\n
Who is Forest Blizzard?<\/strong><\/p>\n\n\n\n
The group Microsoft tracks as Forest Blizzard (STRONTIUM)<\/a> is a Russian state-sponsored threat actor that primarily targets government, energy, transportation, and non-governmental organizations in the United States, Europe, and the Middle East. The United States and United Kingdom governments<\/a> have linked Forest Blizzard to Unit 26165 of the Russian Federation\u2019s military intelligence agency: Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).<\/p>\n\n\n\n
Forest Blizzard commonly seeks and employs publicly available exploits in addition to CVE-2023-23397. Beginning in at least the first half of September 2023, Forest Blizzard actors leveraged the WinRAR CVE 2023-38831<\/a> vulnerability to adapt spear-phishing operations against chiefly Ukrainian government targets. Other known exploits leveraged by Forest Blizzard include CVE-2021-40444<\/a>, CVE-2021-42292<\/a>, CVE-2021-42321<\/a>, CVE-2021-34473<\/a>, CVE-2020-17144<\/a>, and CVE-2020-0688<\/a>.<\/p>\n\n\n\n
Forest Blizzard continually refines its footprint by employing new custom techniques and malware, suggesting that it is a well-resourced and well-trained group posing long-term challenges to attribution and tracking its activities. Microsoft continually updates detections and protections against this threat group based on our telemetry and research. Other security researchers have used GRU Unit 26165, APT28<\/a>, Sednit<\/a>, Sofacy<\/a>, and Fancy Bear<\/a> to refer to groups with similar or related activities.<\/p>\n\n\n\n
<\/p>\n<\/blockquote>\n\n\n\n
<\/p>\n\n\n\n
This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397<\/a>. A successful exploit of this vulnerability can result in unauthorized access to an organization\u2019s environment by triggering a Net-NTLMv2 hash leak. Understanding the vulnerability and how it has been leveraged by threat actors can help guide the overall investigative process.<\/p>\n\n\n\n
This document covers:<\/p>\n\n\n\n
\n
- An overview of the vulnerability<\/li>\n\n\n\n
- Exploit scenarios<\/li>\n\n\n\n
- Post-exploit activities observed in attacks<\/li>\n\n\n\n
- Techniques for determining if an organization was targeted or compromised via this vulnerability<\/li>\n\n\n\n
- Mitigations available to protect your environment<\/li>\n<\/ul>\n\n\n\n
Exploitation of CVE-2023-23397 leaves very few forensic artifacts to discover in traditional endpoint forensic analysis. This blog describes how Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) was able to detect the abuse of CVE-2023-23397 and how organizations can identify historical and present evidence of compromise through this vulnerability.<\/p>\n\n\n\n
This vulnerability triggers a Net-NTLMv2 hash leak. Abuse of the leaked Net-NTLMv2 hash is post-exploitation activity. In this blog, we emphasize specific observed post-exploitation activity that targeted Microsoft Exchange Server. However, there are numerous ways that a leaked Net-NTLMv2 hash could be used by a threat actor.<\/p>\n\n\n\n
Understanding the CVE-2023-23397 vulnerability<\/h2>\n\n\n\n
CVE-2023-23397 is a critical elevation of privilege vulnerability in Microsoft Outlook on Windows. It is exploited when a threat actor delivers a specially crafted message to a user. This message includes the PidLidReminderFileParameter<\/em> extended Messaging Application Programming Interface (MAPI) property, which must be set to a Universal Naming Convention (UNC) path share on a threat actor-controlled server (via Server message block (SMB)\/transmission control protocol (TCP) port 445).<\/p>\n\n\n\n
In exploitation of CVE-2023-23397, threat actors can specify the value for the PidLidReminderFileParameter<\/em> in specially crafted messages to trigger a Net-NTLMv2 hash leak to threat actor-controlled servers.<\/p>\n\n\n\n
The user does not need to interact with the message: if Outlook on Windows is open when the reminder is triggered, it allows exploitation. The connection to the remote SMB server sends the user\u2019s Net-NTLMv2 hash in a negotiation message, which the threat actor can either a) relay for authentication against other systems that support NTLMv2 authentication or b) perform offline cracking to extract the password. As these are NTLMv2 hashes, they cannot be leveraged as part of a Pass-the-Hash technique. All versions of Microsoft Outlook on Windows are impacted. Outlook for Android, iOS, Mac, and users who use Outlook on the web (OWA) without using the Outlook client are not affected.<\/p>\n\n\n\n
Microsoft has traced evidence of potential exploitation of this vulnerability as early as April 2022.<\/p>\n\n\n\n
This technique leverages the Transport Neutral Encapsulation Format (TNEF). TNEF is a Microsoft-specific format for transmitting formatted email messages. A TNEF message contains a plaintext version of the message and an attachment that packages the original formatted version of the message. Typically, this attachment is named Winmail.dat<\/em>. The Winmail.dat<\/em> attachment includes formatting, attachments, and Outlook-specific features such as meeting requests including extended MAPI Properties. Details about TNEF can be found here:<\/p>\n\n\n\n
\n
- https:\/\/learn.microsoft.com\/office\/client-developer\/outlook\/mapi\/transport-neutral-encapsulation-format-tnef<\/a><\/li>\n\n\n\n
- https:\/\/learn.microsoft.com\/exchange\/mail-flow\/content-conversion\/content-conversion<\/a>.<\/li>\n<\/ul>\n\n\n\n
Outlook on Windows is designed to enable a user to specify a custom sound file associated with a reminder.<\/p>\n\n\n\n