Microsoft has released a new guide to help users determine whether or not a threat actor tried to steal sensitive data by exploiting a recently patched zero-day vulnerability found in its Outlook email (opens in new tab) client.
The vulnerability is tracked as CVE-2023-23397, and it’s described as a privilege escalation security flaw on Windows, allowing threat actors to steal NTLM hashes without the victim interacting on their side of the endpoint. The attack is called NTLM-relay zero-click attack.
Tarlogic describes NTLM hashes as “cryptogrpahic formats” in which Windows stores user passwords. These hashes are stored in the Security Account Manager (SAM), or NTDS file of a domain controller. “They are a fundamental part of the mechanism used to authenticate a user through different communications protocols,” it says.
Multiple signs of exploitation
To leverage the flaw and steal these hashes, a threat actor can send a specially crafted message with extended MAPI properties. These will contain UNC paths (Universal naming convention paths, used to access network resources) to attacker-controlled Server Message Block (SMB) shares.
Now, back to what Microsoft did – the Redmond software giant claims there are multiple signs of exploitation that IT teams can analyze: telemetry data from firewalls, proxies, VPN tools, RDP Gateway logs, Azure Active Directory sign-in logs for Exchange Online users, or IIS Logs for Exchange Server.
They can also look for data like Windows event logs, or telemetry data from endpoint detection and response solutions. Threat actors will often target Exchange EWS/OWA users, and look to change mailbox folder permissions to grant themselves persistent access, which is also what IT teams can look for, Microsoft concluded.
“To address this vulnerability, you must install the Outlook security update, regardless of where your mail is hosted (e.g., Exchange Online, Exchange Server, some other platform) or your organization’s support for NTLM authentication,” the Microsoft Incident Response team said.
Finally, the company also released a script that helps admins automate the process and determine if any Exchange users were compromised.
Via: BleepingComputer (opens in new tab)
