Windows: Outlook querying WebClient/LanmanWorkstation registry network provider keys
Flags Outlook.exe querying HKLM\SYSTEM\Services WebClient/LanmanWorkstation NetworkProvider registry values.
- Product
- windows
- Service
- security
- Author
- Robert Lee @quantum_cookie (SigmaHQ), DRL 1.1
- Published
- 2023-03-16
- Updated
- 2026-07-31
What it detects
This rule identifies Windows events where Outlook initiates access to registry keys associated with WebClient and LanmanWorkstation network providers. Attackers may use Outlook-driven behavior as part of a workflow that includes querying these configuration points during exploitation attempts. The detection relies on Windows security telemetry for registry object access (Event IDs 4656 and 4663) including the process name ending with OUTLOOK.EXE and the accessed registry object path and access mask for querying values.
Reporting behind it
- trustedsec.comhttps://www.trustedsec.com/blog/critical-outlook-vulnerability-in-depth-technical-analysis-and-recommendations-cve-2023-23397/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Outlook querying WebClient/LanmanWorkstation registry network provider keys"
id: 96bd9d83-53e3-4544-85bd-bdfd4c798c91
status: test
description: This rule identifies Windows events where Outlook initiates access to registry keys associated with WebClient and LanmanWorkstation network providers. Attackers may use Outlook-driven behavior as part of a workflow that includes querying these configuration points during exploitation attempts. The detection relies on Windows security telemetry for registry object access (Event IDs 4656 and 4663) including the process name ending with OUTLOOK.EXE and the accessed registry object path and access mask for querying values.
author: Robert Lee @quantum_cookie, Huntrule Team
date: 2023-03-16
modified: 2023-03-22
references:
- https://www.trustedsec.com/blog/critical-outlook-vulnerability-in-depth-technical-analysis-and-recommendations-cve-2023-23397/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml
tags:
- attack.credential-access
- attack.initial-access
- cve.2023-23397
- detection.emerging-threats
logsource:
service: security
product: windows
definition: 'Requirements: SACLs must be enabled for "Query Value" on the registry keys used in this rule'
detection:
selection:
EventID:
- 4656
- 4663
ProcessName|endswith: \OUTLOOK.EXE
ObjectName|contains|all:
- \REGISTRY\MACHINE\SYSTEM
- Services\
ObjectName|endswith:
- WebClient\NetworkProvider
- LanmanWorkstation\NetworkProvider
AccessList|contains: "%%4416"
condition: selection
falsepositives:
- Searchprotocolhost.exe likes to query these registry keys. To avoid false postives, it's better to filter out those events before they reach the SIEM
level: critical
license: DRL-1.1
related:
- id: 73c59189-6a6d-4b9f-a748-8f6f9bbed75c
type: derived