Forced authentication via external resources in Outlook

This procedure is the Outlook-on-Windows CVE-2023-23397 form of ATT&CK T1187. A specially crafted Outlook item carries the extended MAPI PidLidReminderFileParameter property pointing to a UNC path on an attacker-controlled SMB server. When the reminder fires while a vulnerable Outlook client is running, the client initiates SMB over TCP 445 and sends the signed-in user's Net-NTLMv2 challenge-response without user interaction. This yields challenge-response material, not a cleartext password. The procedure requires an unpatched Outlook for Windows client and outbound SMB reachability. A plain UNC string in an email body or an ordinary external HTML image is not an equivalent trigger; patched Outlook ignores an untrusted remote path.