Merge PR #5691 from @djlukic - Adding RemoteAddress field for Windows Server coverage

fix: Potential CVE-2023-23397 Exploitation Attempt - Add RemoteAddress field to filters
---------
Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>

Author: djlukic

rules-emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml

@@ -7,7 +7,7 @@ references:
     - https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-04-05
-modified: 2025-04-07
+modified: 2025-10-13
 tags:
     - attack.exfiltration
     - cve.2023-23397
@@ -73,6 +73,18 @@ detection:
               - '0200????0A' # 10.
               - '0200????7F' # 127
               - '0200????A9FE' # 169.254.
+        - RemoteAddress|contains:
+              # IPv6
+              - '00000000000000000000000000000001' # ::1 - IPv6 loopback
+              - 'FE80000000000000' # fe80:: - IPv6 link-local addresses
+              - 'FC00000000000000' # fc00:: - IPv6 private addresses
+              # IPv4
+              # The "?" are meant to represent the port
+              - '0200????C0A8' # 192.168.
+              - '0200????AC' # 172.
+              - '0200????0A' # 10.
+              - '0200????7F' # 127
+              - '0200????A9FE' # 169.254.
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Some false positives may occur from external trusted servers. Apply additional filters accordingly