Windows: Outlook.exe registry query for WebClient/LanmanWorkstation network provider keys

Flags Outlook.exe querying HKLM\SYSTEM\Services WebClient/LanmanWorkstation NetworkProvider registry values.

FreeUnreviewedSigmacriticalv1

windows-outlook-exe-registry-query-for-webclient-lanmanworkstation-network-provi-73c59189

title: "Windows: Outlook.exe registry query for WebClient/LanmanWorkstation network provider keys"
id: 96bd9d83-53e3-4544-85bd-bdfd4c798c91
status: test
description: This rule identifies Outlook.exe initiating registry access events consistent with querying network provider configuration under WebClient or LanmanWorkstation. Such activity can be indicative of attempts to leverage known Windows network provider behavior during exploitation of CVE-2023-23397. It relies on Windows security telemetry for registry handle operations (EventID 4656/4663), process name matching to OUTLOOK.EXE, registry object path patterns under HKLM\SYSTEM\Services, and the access mask indicating a key-value query.
author: Robert Lee @quantum_cookie, Huntrule Team
date: 2023-03-16
modified: 2023-03-22
references:
  - https://www.trustedsec.com/blog/critical-outlook-vulnerability-in-depth-technical-analysis-and-recommendations-cve-2023-23397/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml
tags:
  - attack.credential-access
  - attack.initial-access
  - cve.2023-23397
  - detection.emerging-threats
logsource:
  service: security
  product: windows
  definition: 'Requirements: SACLs must be enabled for "Query Value" on the registry keys used in this rule'
detection:
  selection:
    EventID:
      - 4656
      - 4663
    ProcessName|endswith: \OUTLOOK.EXE
    ObjectName|contains|all:
      - \REGISTRY\MACHINE\SYSTEM
      - Services\
    ObjectName|endswith:
      - WebClient\NetworkProvider
      - LanmanWorkstation\NetworkProvider
    AccessList|contains: "%%4416"
  condition: selection
falsepositives:
  - Searchprotocolhost.exe likes to query these registry keys. To avoid false postives, it's better to filter out those events before they reach the SIEM
level: critical
license: DRL-1.1
related:
  - id: 73c59189-6a6d-4b9f-a748-8f6f9bbed75c
    type: derived

What it detects

This rule identifies Outlook.exe initiating registry access events consistent with querying network provider configuration under WebClient or LanmanWorkstation. Such activity can be indicative of attempts to leverage known Windows network provider behavior during exploitation of CVE-2023-23397. It relies on Windows security telemetry for registry handle operations (EventID 4656/4663), process name matching to OUTLOOK.EXE, registry object path patterns under HKLM\SYSTEM\Services, and the access mask indicating a key-value query.

Known false positives

Searchprotocolhost.exe likes to query these registry keys. To avoid false postives, it's better to filter out those events before they reach the SIEM

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.