Detecting CVE-2023-23397 in office content?

[DaveBunn]

CVE-2023-23397 is all the rage right now.
Has anyone figured out a way to detect this in office content?
I've checked all Microsoft docs I can find, but nothing informs me as to what I'm actually looking for inside an email or contact etc.

[paulcurry]

MS has some pwershell things to look for in your environment.  Eith on-prem Exchange or Cloud-based.  

https://github.com/microsoft/CSS-Exchange/blob/a4c096e8b6e6eddeba2f42910f165681ed64adf7/docs/Securit...

[pneray]

This blog post might help: https://www.cardinalops.com/en/resources/detecting-microsoft-outlook-vulnerability-cve-2023-23397-sp...

[Stjubit147]

You can check out our thread about this in the user group: https://splunk-usergroups.slack.com/archives/CDNHXVBGS/p1678882662724229.

[DaveBunn]

Hi

I'm not a member of "splunk-usergroups on Slack" so can't see the detail you are referencing

[Stjubit147]

You won't regret joining it: https://docs.splunk.com/Documentation/Community/current/community/Chat