CVE-2023-23397 — Purple Team: Exploit + Detection

Two halves of one project against the same Outlook NTLM-leak vulnerability (CVE-2023-23397):

• Red team (done): phishing delivery + exploitation of CVE-2023-23397 against a Windows 10 victim VM, full writeup in FINAL_PROJECT_REPORT.pdf, walkthrough in FINAL_DEMO_VIDEO.mp4, slides in Presentation.pptx. Delivery scripts (send_malicious_email.py, malicious_email_url.py) and the phishing lure page (index.html) are included for reference.
• Blue team (in progress): detection-engineering-lab/ — Sigma/Wazuh detections for every stage of that same attack chain, mapped to MITRE ATT&CK, each with a measured false-positive rate against a benign baseline, plus a small automation layer that summarizes daily alerts.