SenseOn’s approach to threat is to provide a mixture of behavioural and machine learning detections to identify behaviors such as lateral movement, command and control (C2) traffic and exfiltration. In addition to this, SenseOn have various detections targeting related behaviour patterns that the SenseOn SOC are monitoring. SenseOn provides detections to identify abnormal external connections over uncommon protocols, which will allow us to identify attempts to communicate to external servers over SMB port 445. SenseOn’s detection capabilities mean that we are able to provide coverage across the estate for post breach activities related to this vulnerability. Alternatively, it is recommended outbound SMB connections (TCP port 445) are blocked. If it is not possible to apply these security updates, Microsoft has advised adding users to the ‘Protected Users Security Group’ which will prevent the use of NTLM for authentication. Online services including Microsoft 365 do not support NTLM authentication and therefore are not vulnerable to this exploit.Īll currently supported versions of Outlook for Windows are impacted by this vulnerability and Microsoft has released a security update for this that SenseOn recommends. This can then be reused for authentication against other NTLM supported systems. Once the email is received the device will connect to the SMB share sending the user an NTLM negotiation message.

The crafted email will contain a MAPI property which has a path to an SMB share that the threat actor controls. The group have targeted numerous sectors in Europe including government, transport, energy, and military. The vulnerability, tracked under CVE-2023-23397, allows attackers to obtain NTLM hashes by sending specially crafted emails to a victim which will exploit the vulnerability without their interaction.Īccording to Microsoft Security Resource Center (MSRC), this vulnerability has been actively exploited since April 2022 by the Russia-based threat actor APT28. On the 14th March 2023, Microsoft published details of a critical Outlook vulnerability known to have been exploited by threat actors. SenseOn Advisory on the Outlook Zero Day Vulnerability

Outlook ltsc