Add Support for XML

rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml

@@ -4,9 +4,10 @@ status: test
 description: Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.
 references:
     - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
+    - https://github.com/nasbench/Misc-Research/blob/main/ETW/Microsoft-Windows-SMBClient.md
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-04-05
-modified: 2025-03-20
+modified: 2025-04-07
 tags:
     - attack.exfiltration
     - cve.2023-23397
@@ -25,18 +26,53 @@ detection:
             # - 31001 # Error (Doesn't contain the "ServerAddress" field)
     filter_main_local_ips:
         - ServerAddress|cidr:
+              # IPv4
               - '10.0.0.0/8'
               - '127.0.0.0/8'
               - '169.254.0.0/16'
               - '172.16.0.0/12'
               - '192.168.0.0/16'
+              # IPv6
+              - '::1/128'  # IPv6 loopback
+              - 'fe80::/10'  # IPv6 link-local addresses
+              - 'fc00::/7'  # IPv6 private addresses
         - Address|startswith:
         # This is for EventID 30804, which doesn't have the "ServerAddress" field, but a field called "Address" and it contains a socket address (IP:Port) and not an IP
+              # IPv4
               - '10.'
               - '127.'
               - '169.254.'
               - '172.'
               - '192.168.'
+              # IPv6
+              - '::1'
+              - 'fe80::'
+              - 'fc00::'
+        # The filters below cover the XML raw log
+        - Address|contains:
+              # IPv6
+              - '00000000000000000000000000000001' # ::1 - IPv6 loopback
+              - 'FE80000000000000' # fe80:: - IPv6 link-local addresses
+              - 'FC00000000000000' # fc00:: - IPv6 private addresses
+              # IPv4
+              # The "?" are meant to represent the port
+              - '0200????C0A8' # 192.168.
+              - '0200????AC' # 172.
+              - '0200????0A' # 10.
+              - '0200????7F' # 127
+              - '0200????A9FE' # 169.254.
+        - ServerAddress|contains:
+              # IPv6
+              - '00000000000000000000000000000001' # ::1 - IPv6 loopback
+              - 'FE80000000000000' # fe80:: - IPv6 link-local addresses
+              - 'FC00000000000000' # fc00:: - IPv6 private addresses
+              # IPv4
+              # The "?" are meant to represent the port
+              - '0200????C0A8' # 192.168.
+              - '0200????AC' # 172.
+              - '0200????0A' # 10.
+              - '0200????7F' # 127
+              - '0200????A9FE' # 169.254.
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Some false positives may occur from external trusted servers. Apply additional filters accordingly