Guidance for investigating attacks using CVE-2023-23397

This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397. A successful exploit of this vulnerability can result in unauthorized access to an organization’s environment by triggering a Net-NTLMv2 hash leak. Understanding the vulnerability and how it has been leveraged by threat actors can help guide the overall investigative process.

This document covers:

• An overview of the vulnerability


• Exploit scenarios


• Post-exploit activities observed in attacks


• Techniques for determining …

access attacks compromised cve cve-2023-23397 document environment exploit exploiting guidance guide hash leak mitigations organization organizations process protect result techniques threat threat actors unauthorized access understanding vulnerability