Does EDR Capture CVE-2023-23397 in a Threat Intelligence Feed?

Products

• Carbon Black EDR

Issue/Introduction

Does the EDR server have a threat intelligence feed to monitor for CVE-2023-23397?

• Microsoft Outlook Elevation of Privilege Vulnerability 

Environment

• Carbon Black EDR Server: All Supported Versions
• Threat Intelligence

Resolution

1. Create a watchlist specific to the environment that looks for netconns to standard SMB and LDAP ports for IP ranges outside of normal authentication infrastructure locations.

Additional Information

• The detecting the malicious message properties themselves is something better handled by an email security gateway as this is all happening on the network layer.