The project validates forced outbound SMB/NTLM behavior associated with CVE-2023-23397 and the corresponding detection and mitigation controls. It does not prove that Outlook processed a malicious MAPI message or that CVE-2023-23397 was exploited.

Research Documents

Project Goals

The primary goals of this project are to:

• Build an isolated multi-network cybersecurity laboratory.
• Observe normal SMB and NTLM authentication behavior.
• Capture and preserve network evidence.
• Develop a custom Zeek detection for suspicious outbound NTLM authentication.
• Validate the detection using controlled traffic.
• Test gateway-based SMB mitigation.
• Test Windows host-based SMB mitigation.
• Compare pre-mitigation and post-mitigation behavior.
• Map the observed security behavior to MITRE ATT&CK.
• Produce reproducible evidence suitable for defensive security research.

Lab Architecture

The laboratory contains three virtual machines.

Logical traffic path:

The victim and adversary networks are isolated from each other.

Traffic between them must traverse Ubuntu-Sensor, allowing the sensor to observe and control the communication.

A separate VMware management network is used for administrative SSH access to Ubuntu-Sensor.

More information:

lab/network-plan.md

Threat Scenario

CVE-2023-23397 is associated with forced outbound authentication behavior involving Microsoft Outlook.

The security-relevant behavior is a Windows system attempting to authenticate to an attacker-controlled network resource.

This laboratory focuses on the observable network behavior:

The laboratory does not claim that every generated SMB event represents exploitation of the Outlook vulnerability.

Instead, controlled SMB and NTLM traffic is used to safely develop and validate defensive detection logic.

Detailed analysis:

docs/attack-flow.md

MITRE ATT&CK Mapping

Primary technique:

T1187 - Forced Authentication

Primary tactic:

Credential Access

The project focuses on detecting and preventing suspicious outbound authentication from a protected workstation toward an untrusted destination.

Baseline Traffic Analysis

The first phase established normal routed communication between the Windows victim and the controlled adversary.

Baseline packet captures and Zeek connection logs were collected before detection logic was introduced.

This provided a reference point for later comparison.

Analysis:

docs/baseline-traffic-analysis.md

SMB and NTLM Baseline

A controlled SMB server was hosted on Kali-Adversary.

Windows-Victim successfully accessed:

Zeek successfully parsed:

• TCP/445 communication
• SMB
• NTLM
• SMB share mappings
• SMB file activity
• successful NTLM authentication

The baseline demonstrated that the sensor could observe the complete authentication path before custom detection logic was introduced.

Analysis:

docs/smb-baseline-analysis.md

Custom Zeek Detection

A custom Zeek detector was developed:

detections/zeek/cve_2023_23397_ntlm.zeek

The detector generates:

The rule evaluates four main conditions:

1. The source belongs to the protected victim network.
2. The destination belongs to the controlled untrusted network.
3. The destination port is TCP/445.
4. Zeek observes an NTLM Authenticate event.

This provides more context than alerting on TCP/445 alone.

Detection logic:

A five-minute suppression interval is used to reduce duplicate notices for repeated authentication toward the same destination.

Detection Validation

The custom detector was successfully validated using controlled SMB and NTLM traffic.

The validated event demonstrated correlation between:

• TCP connection telemetry
• SMB communication
• NTLM authentication
• Zeek connection UID
• custom Notice Framework alert

A validated alert included:

The detection analysis and integrity-verified evidence are documented in:

docs/ntlm-detection-analysis.md

Gateway Mitigation

The first mitigation was applied on Ubuntu-Sensor.

The gateway blocked forwarded TCP/445 traffic from:

to:

After the rule was enabled:

Observed result:

• Windows TCP/445 connectivity failed.
• The sensor observed SYN attempts and retransmissions.
• The firewall DROP counter increased.
• No complete TCP handshake occurred.
• No SMB session was established.
• No new NTLM authentication occurred.
• No new custom NTLM alert was generated.

Validation:

docs/mitigation-validation.md

Windows Host Mitigation

A second mitigation was tested using Windows Defender Firewall.

The endpoint blocked outbound:

Observed result:

• TCP/445 connectivity failed.
• SMB access failed.
• Ubuntu-Sensor captured zero matching TCP/445 frames.
• No new NTLM authentication reached the sensor.
• No new custom Zeek notice was generated.

This demonstrated an important difference between the two defensive control points.

Gateway filtering

The network sensor retains visibility into the blocked attempt.

Host filtering

The packet never reaches the external network sensor.

Validation:

docs/windows-host-mitigation-validation.md

Detection and Mitigation Comparison

This demonstrates both detective and preventive controls.

Defense in Depth

The laboratory demonstrates that detection and prevention should be used together.

The defensive model includes:

Gateway controls provide centralized enforcement and network visibility.

Host controls stop unwanted communication earlier.

Zeek provides visibility when suspicious authentication reaches the monitored network path.

Evidence

The repository preserves evidence collected during the experiments.

Packet captures

Stored under:

evidence/pcap/

Examples include:

• baseline traffic
• SMB baseline traffic
• NTLM detection validation
• gateway post-mitigation traffic
• Windows host-block validation

Zeek and mitigation logs

Stored under:

evidence/logs/

Evidence includes:

• Zeek connection logs
• SMB logs
• NTLM logs
• custom notice logs
• firewall validation output
• mitigation validation results

SHA-256 hashes are recorded in the corresponding analysis documents to support evidence integrity.

Repository Structure

Validated Project Workflow

The current project has successfully completed:

Current Tooling

Validated tools used in the current implementation include:

• VMware Workstation
• Windows 10
• Ubuntu Linux
• Kali Linux
• Zeek
• ZeekControl
• tcpdump
• Impacket SMB Server
• Linux iptables
• Windows Defender Firewall
• Git
• GitHub
• PowerShell

Future Work

Potential future improvements include:

• Sysmon endpoint telemetry
• Sigma detection rules
• Suricata network detection
• stronger endpoint-to-network event correlation
• automated detection testing
• false-positive evaluation
• additional detection tuning
• screenshot-based evidence documentation

These items are future work and are not presented as completed capabilities.

Limitations

The laboratory primarily validates network-observable SMB and NTLM behavior.

The current controlled tests demonstrate the authentication behavior relevant to CVE-2023-23397 but do not claim to reproduce every component of real-world Outlook exploitation.

The custom rule is designed for the defined laboratory trust boundaries and would require tuning before use in a production environment.

Latest Live Validation

The live three-VM environment was revalidated on 2026-09-11. The run confirmed the routed packet path, controlled SMB/NTLM telemetry, detector loading, correlated custom notices, negative cases, gateway and host blocking, and rollback recovery.

Key evidence is consistent across the repository:

• The baseline contains 91 IPv4/TCP445 packets on each Ubuntu interface; all 91 packets match across the routed path with a one-hop TTL change.
• The gateway block shows 5 TCP/445 packets on ens33, 0 on ens34, and an iptables counter of 5 packets / 260 bytes.
• The host block shows 0 TCP/445 packets on both interfaces, while each interface captured 6 ICMP control packets.
• Baseline connection, NTLM and notice records correlate through UID CCpuF7S8CCLEmpKsd.
• Two live NTLM authentications occurred 234.473 seconds apart and produced one notice under the five-minute suppression interval.

The validated conclusion is limited to forced outbound SMB/NTLM behavior associated with CVE-2023-23397 and the corresponding detection and mitigation controls. The project does not prove that Outlook processed a malicious MAPI message or that CVE-2023-23397 was exploited.

See docs/live-validation-2026-09-11.md and evidence/validation-20260911/.

Ethical and Legal Notice

All testing documented in this repository is conducted within an isolated and controlled laboratory environment using systems owned or explicitly authorized for testing.

The project is intended exclusively for:

• cybersecurity education
• defensive security research
• network monitoring
• detection engineering
• mitigation analysis

No production systems or unauthorized external systems are targeted.