Microsoft Outlook RCE via Moniker Link (MonikerLink)

// CVE-2024-21413 — Microsoft Outlook MonikerLink RCE
// Detect potential exploitation: outbound SMB/NTLM auth from Outlook process,
// and file:// link clicks that trigger external auth challenges
let SuspiciousOutlookNetworkEvents = 
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where RemotePort in (445, 139, 80, 443)
| where RemoteIPType == "Public"
| extend ThreatIndicator = "CVE-2024-21413-Outlook-External-SMB"
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
    RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine;
let SuspiciousNTLMAuth =
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType == "NetworkConnectionInspected" or ActionType == "ConnectionInspected"
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where AdditionalFields has_any ("NTLM", "NTLMv2", "file://")
| extend ThreatIndicator = "CVE-2024-21413-NTLM-Leak";
SuspiciousOutlookNetworkEvents
| union SuspiciousNTLMAuth
| sort by TimeGenerated desc

index=endpoint sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "crowdstrike:events:sensor")
(
  (EventCode=3 OR event_simpleName="NetworkConnectIP4")
  AND (Image="*\\OUTLOOK.EXE" OR ParentImage="*\\OUTLOOK.EXE" OR process_name="OUTLOOK.EXE")
  AND dest_port IN (445, 139)
  AND NOT (dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1"))
)
| eval CVE="CVE-2024-21413"
| eval ThreatType="Outlook-MonikerLink-NTLM-Leak"
| stats count AS OutboundSMBAttempts,
        values(dest_ip) AS ExternalIPs,
        values(dest_port) AS Ports,
        dc(dest_ip) AS UniqueExternalIPs
  BY host, user, CVE, ThreatType, span=1h _time
| where OutboundSMBAttempts >= 1
| eval Severity="CRITICAL"
| table _time, host, user, ExternalIPs, Ports, OutboundSMBAttempts, UniqueExternalIPs, CVE, Severity, ThreatType
| sort - OutboundSMBAttempts