CVE-2024-21413: Microsoft Outlook RCE via Moniker Link (MonikerLink)

let moniker_pattern = @'(?i)file://[^\s]*![^\s]*';
union
(
  EmailUrlInfo
  | where Url matches regex moniker_pattern
  | project TimeGenerated, NetworkMessageId, Url, UrlDomain, ReportId
  | extend DetectionSource = 'EmailUrlInfo'
),
(
  DeviceNetworkEvents
  | where RemotePort == 445 or RemotePort == 139
  | where InitiatingProcessFileName =~ 'OUTLOOK.EXE' or InitiatingProcessFileName =~ 'outlook.exe'
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, LocalIP
  | extend DetectionSource = 'OutlookSMBEgress'
),
(
  DeviceProcessEvents
  | where InitiatingProcessFileName =~ 'OUTLOOK.EXE'
  | where FileName in~ ('cmd.exe','powershell.exe','wscript.exe','mshta.exe','rundll32.exe','regsvr32.exe')
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
  | extend DetectionSource = 'OutlookChildProcess'
)
| where TimeGenerated > ago(7d)
| sort by TimeGenerated desc

index=* sourcetype IN ("ms:o365:reporting:messagetrace", "ms:defender:atp:devicenetworkevents", "ms:defender:atp:deviceprocessevents", "ms:o365:defender:emailurlinfo")
| eval is_moniker_url=if(match(url, "(?i)file://[^\s]*![^\s]*"), 1, 0),
     is_outlook_smb=if((sourcetype="ms:defender:atp:devicenetworkevents" AND (RemotePort=445 OR RemotePort=139) AND match(InitiatingProcessFileName, "(?i)outlook\.exe")), 1, 0),
     is_outlook_child=if((sourcetype="ms:defender:atp:deviceprocessevents" AND match(InitiatingProcessFileName, "(?i)outlook\.exe") AND match(FileName, "(?i)(cmd|powershell|wscript|mshta|rundll32|regsvr32)\.exe")), 1, 0)
| where is_moniker_url=1 OR is_outlook_smb=1 OR is_outlook_child=1
| eval detection_source=case(is_moniker_url=1, "MonikerURLInEmail", is_outlook_smb=1, "OutlookSMBEgress", is_outlook_child=1, "OutlookChildProcess", true(), "unknown")
| table _time, host, user, url, RemoteIP, RemotePort, InitiatingProcessFileName, FileName, ProcessCommandLine, detection_source
| sort -_time

sequence by host.name with maxspan=5m
  [network where process.name : "OUTLOOK.EXE" and destination.port in (445, 139) and network.direction : "egress"]
  [process where process.parent.name : "OUTLOOK.EXE" and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")]

/* Standalone: moniker URL in email events */
/* any where event.dataset == "o365.audit" and message : "file://*!*" */

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  "Image" AS process_image,
  "ParentImage" AS parent_image,
  "CommandLine" AS command_line,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Sysmon', 'Microsoft Defender ATP')
  AND (
    ("ParentImage" ILIKE '%OUTLOOK.EXE%' AND "Image" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%mshta.exe%', '%rundll32.exe%', '%regsvr32.exe%'))
    OR ("Image" ILIKE '%OUTLOOK.EXE%' AND destinationport IN (445, 139))
  )
  AND LOGSOURCESTARTTIME(devicetime) > NOW() - 7 DAYS
ORDER BY starttime DESC
LAST 10000

_sourceCategory=windows* OR _sourceCategory=defender* OR _sourceCategory=o365*
| parse regex field=_raw "(?i)(?P<parent_process>OUTLOOK\.EXE)" nodrop
| parse regex field=_raw "(?i)file://[^\s]*!(?P<moniker_path>[^\s]+)" nodrop
| parse regex field=_raw "DestinationPort.*?(?P<dest_port>445|139)" nodrop
| parse regex field=_raw "(?i)Image.*?(?P<child_proc>(cmd|powershell|wscript|mshta|rundll32|regsvr32)\.exe)" nodrop
| where !isNull(parent_process) or !isNull(moniker_path)
| if(!isNull(moniker_path), "MonikerURLDetected",
    if(!isNull(dest_port), "OutlookSMBEgress",
      if(!isNull(child_proc), "OutlookChildProcess", "Unknown"))) as detection_type
| count by _sourceHost, detection_type, moniker_path, dest_port, child_proc
| sort by _count desc

rule cve_2024_21413_monikerlink_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2024-21413 MonikerLink RCE exploitation via Outlook SMB egress and child process spawn"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    $network.principal.process.file.full_path = /(?i)OUTLOOK\.EXE/
    ($network.target.port = 445 or $network.target.port = 139)

    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.principal.process.file.full_path = /(?i)OUTLOOK\.EXE/
    $process.target.process.file.full_path = /(?i)(cmd|powershell|wscript|mshta|rundll32|regsvr32)\.exe/
    $process.principal.hostname = $network.principal.hostname

  match:
    $network.principal.hostname over 5m

  condition:
    $network and $process
}

#event_simpleName IN (NetworkConnectIP4, ProcessRollup2)
| case {
    #event_simpleName = "NetworkConnectIP4" AND ImageFileName = /(?i)\\OUTLOOK\.EXE$/ AND (RemotePort = 445 OR RemotePort = 139)
      | eval detection_type = "OutlookSMBEgress", indicator = RemoteIP;
    #event_simpleName = "ProcessRollup2" AND ParentBaseFileName =~ "OUTLOOK.EXE" AND FileName = /(cmd|powershell|wscript|mshta|rundll32|regsvr32)\.exe/i
      | eval detection_type = "OutlookChildProcess", indicator = CommandLine;
}
| where isnotnull(detection_type)
| eval cve = "CVE-2024-21413"
| table timestamp, aid, ComputerName, UserName, ImageFileName, FileName, CommandLine, RemoteIP, RemotePort, detection_type, cve
| sort -timestamp
| limit 1000