CVE-2023-23397 is a critical Outlook vulnerability (CVSS 9.8) that allows remote attackers to extract NTLM credential hashes without user interaction by sending specially crafted calendar invitations. Detection focuses on identifying suspicious Outlook process behavior, NTLM authentication attempts to external hosts, and anomalous network connections initiated by Outlook.

let SuspiciousOutlookProcesses = dynamic(['outlook.exe', 'msaccess.exe', 'winword.exe']); let NTLMPorts = dynamic([445, 139]); union (DeviceProcessEvents | where Timestamp > ago(7d) | where ProcessFileName has_any (SuspiciousOutlookProcesses) | where ProcessCommandLine has_any (@'\calendar', @'\invite', @'\ics') | project Timestamp, DeviceId, DeviceName, ProcessFileName, ProcessCommandLine, AccountName, ProcessId), (DeviceNetworkEvents | where Timestamp > ago(7d) | where InitiatingProcessFileName has_any (SuspiciousOutlookProcesses) | where RemotePort in (NTLMPorts) or Protocol =~ 'NTLM' | where RemoteIPType == 'Public' | project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, Protocol, InitiatingProcessCommandLine, AccountName), (DeviceNetworkEvents | where Timestamp > ago(7d) | where InitiatingProcessFileName has_any (SuspiciousOutlookProcesses) | where RemoteUrl has_any (@'.local', @'.internal') or RemoteIP matches regex @'^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' | where ActionType == 'ConnectionSuccess' | project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, AccountName) | summarize EventCount = count() by DeviceId, DeviceName, AccountName, bin(Timestamp, 1h) | where EventCount > 5

Detects CVE-2023-23397 exploitation by identifying Outlook processes with suspicious calendar/invite-related command lines, NTLM authentication attempts to external or internal network resources initiated by Outlook, and anomalous network connections from Outlook to non-standard destinations. Aggregates events to identify patterns of credential hash extraction attempts.

Microsoft Outlook, Microsoft Exchange, Office 365

T1187, T1040, T1557

Legitimate calendar sharing, meeting invitations, and internal network authentication are common in enterprise environments. Tune by excluding known internal domains, trusted calendar servers, and expected NTLM authentication patterns. Consider allowlisting legitimate Outlook add-ins and calendar synchronization services. Monitor for baseline activity patterns per user/device before alerting.

This detection identifies exploitation of CVE-2023-46604 in Apache ActiveMQ servers, which allows remote code execution through malicious serialized class types in OpenWire protocol messages. The query detects suspicious network connections to ActiveMQ ports combined with process execution patterns consistent with Java-based RCE and subsequent ransomware deployment.

let timeframe = 7d; let activemq_ports = dynamic([61616, 5672, 8161]); let suspicious_processes = dynamic(['cmd.exe', 'powershell.exe', 'certutil.exe', 'bitsadmin.exe', 'wmic.exe', 'rundll32.exe']); union (DeviceNetworkEvents | where Timestamp > ago(timeframe) | where RemotePort in (activemq_ports) or RemoteUrl has 'activemq' | where ActionType in ('ConnectionSuccess', 'ConnectionAttempt') | project Timestamp, DeviceId, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine), (DeviceProcessEvents | where Timestamp > ago(timeframe) | where ProcessCommandLine has_any ('java', 'Spring') or FileName in (suspicious_processes) | where FolderPath has_any ('temp', 'appdata', 'windows\system32', 'programdata') | project Timestamp, DeviceId, DeviceName, FileName, ProcessCommandLine, ProcessId, AccountName, FolderPath) | join kind=inner (DeviceNetworkEvents | where Timestamp > ago(timeframe) and RemotePort in (activemq_ports)) on DeviceId | where Timestamp1 >= Timestamp and Timestamp1 <= Timestamp + 5m | project Timestamp, DeviceName, RemoteIP, RemotePort, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName | limit 1000

Correlates inbound network connections to ActiveMQ default ports (61616, 5672, 8161) with subsequent suspicious process execution (cmd.exe, powershell.exe, certutil, bitsadmin, wmic, rundll32) within a 5-minute window on the same device. Identifies Java processes with Spring framework references combined with command-line execution patterns typical of post-exploitation activity and ransomware deployment.

Apache ActiveMQ, Windows, Java Runtime Environment

T1190, T1059, T1486, T1570

Legitimate ActiveMQ administrative tools and monitoring solutions may trigger alerts; whitelist known management IPs and scheduled maintenance windows. Java application servers running Spring framework in normal operations may generate false positives; baseline expected process execution patterns per environment. Filter out internal ActiveMQ cluster communication between trusted nodes. Tune RemotePort detection to exclude non-standard ActiveMQ deployments in your environment.

CVE-2024-50603 is an unauthenticated remote code execution vulnerability in Aviatrix Controller with a CVSS score of 10.0 that enables privilege escalation in AWS control planes. Detection focuses on identifying exploitation attempts targeting Aviatrix Controller endpoints and subsequent suspicious process execution or network activity from affected systems.

let timeframe = 7d; let aviatrix_ports = dynamic([443, 8443]); let aviatrix_paths = dynamic(['/api/', '/v1/', '/controller']); union (DeviceNetworkEvents | where Timestamp > ago(timeframe) | where RemotePort in (aviatrix_ports) or RemoteUrl has_any (aviatrix_paths) | where ActionType == 'ConnectionSuccess' or ActionType == 'ConnectionAttempt' | project Timestamp, DeviceId, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine), (DeviceProcessEvents | where Timestamp > ago(timeframe) | where ProcessCommandLine has_any ('curl', 'wget', 'powershell', 'python') and (ProcessCommandLine contains 'aviatrix' or ProcessCommandLine matches regex @'(?i)(controller|api)') | project Timestamp, DeviceId, DeviceName, ProcessCommandLine, ProcessId, AccountName, FileName), (DeviceProcessEvents | where Timestamp > ago(timeframe) | where ProcessIntegrityLevel == 'System' and AccountName != 'SYSTEM' | where ProcessCreationTime > ago(1h) | project Timestamp, DeviceId, DeviceName, ProcessCommandLine, ProcessId, AccountName, ProcessIntegrityLevel) | summarize EventCount = count(), UniqueDevices = dcount(DeviceId), ProcessNames = make_set(FileName), CommandLines = make_set(ProcessCommandLine) by DeviceName, RemoteIP | where EventCount > 3 or ProcessNames has_any ('cmd.exe', 'powershell.exe', 'bash') | limit 1000

Monitor for network connections to Aviatrix Controller endpoints (ports 443, 8443) with API path patterns, correlate with suspicious process execution (elevated privileges, command shells, scripting tools) on the same device within short time windows, and identify anomalous outbound connections or privilege escalation attempts post-exploitation.

Aviatrix Controller, AWS, Azure, Docker, VMware

T1190, T1133, T4765

Legitimate administrative tools (curl, wget, PowerShell) connecting to Aviatrix for maintenance; scheduled API calls from monitoring/automation systems; normal system processes running with elevated privileges; filter by known Aviatrix management IPs and service accounts; tune based on organizational baseline of Aviatrix API usage patterns.