Microsoft Outlook CVE-2023-23397 (reminder property triggers an NTLM hash leak with no user click, exploited by a state-sponsored actor, CISA KEV): who is affected, what is the fix and how do I hunt for abuse?

What it is: CVE-2023-23397 is a critical elevation-of-privilege flaw in Outlook for Windows. A specially crafted message, task or calendar item can make Outlook connect to an attacker-chosen network path when its reminder fires, sending the user's Net-NTLMv2 hash without the user opening anything. The hash can be relayed to other services or cracked offline. Microsoft fixed it on March 14, 2023, said exploitation dated back to April 2022, and attributed it to the Russian state-sponsored group Forest Blizzard (STRONTIUM). CISA added it to KEV on March 14, 2023. Am I affected: - Outlook for Windows (the NVD lists Outlook 2013, 2016, Office 2019, Office LTSC 2021 and Microsoft 365 Apps). Outlook for Android, iOS, Mac and Outlook on the web are not affected, per Microsoft. - Applies regardless of where mail is hosted, and whether or not you use NTLM elsewhere. Fix: 1. Install the March 2023 (or later) Outlook security update on every Windows client, and keep Office current. 2. Defense in depth recommended by Microsoft: block outbound TCP 445 at perimeter, host firewalls and VPN (including split tunnels); add high-value accounts to the Protected Users group (this blocks NTLM for them, so test first); reduce NTLM use; keep Exchange on a current Security Update, which strips the malicious property from incoming mail. 3. Hunt: Microsoft publishes a script that scans mailboxes for messages with the reminder property pointing to a remote path; treat internet-zone targets as malicious. Also review firewall logs for outbound SMB to unknown hosts and SMB client events in Windows logs, and check Exchange for unusual NTLM logons or folder-permission changes. 4. If abuse is suspected, reset passwords for accounts exposed on affected machines, remove unexpected mailbox folder permissions and start incident response. Verify: the installed Outlook build includes the March 2023 or later update, and outbound 445 is blocked from user networks. Sources: https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/ https://nvd.nist.gov/vuln/detail/CVE-2023-23397 https://www.cisa.gov/known-exploited-vulnerabilities-catalog