Detect Microsoft Outlook RCE via Moniker Link (MonikerLink) in Microsoft Sentinel
CVE-2024-21413 is a critical (CVSS 9.8) remote code execution vulnerability in Microsoft Outlook caused by improper input validation. Dubbed 'MonikerLink', the flaw allows an attacker to craft a malicious hyperlink using the file:// URI scheme combined with an exclamation mark (!), bypassing Outlook's Protected View and MOTW (Mark of the Web) safeguards. When a user clicks the link, Outlook resolves it as a Component Object Model (COM) moniker, triggering NTLM authentication negotiation to an attacker-controlled server (leaking NTLMv2 hashes) and potentially executing arbitrary code. Affected products include Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, and Office LTSC 2021. CISA added this to the KEV catalog with a due date of February 27, 2025, indicating active exploitation in the wild.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
// CVE-2024-21413 — Microsoft Outlook MonikerLink RCE
// Detect potential exploitation: outbound SMB/NTLM auth from Outlook process,
// and file:// link clicks that trigger external auth challenges
let SuspiciousOutlookNetworkEvents =
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where RemotePort in (445, 139, 80, 443)
| where RemoteIPType == "Public"
| extend ThreatIndicator = "CVE-2024-21413-Outlook-External-SMB"
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine;
let SuspiciousNTLMAuth =
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType == "NetworkConnectionInspected" or ActionType == "ConnectionInspected"
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where AdditionalFields has_any ("NTLM", "NTLMv2", "file://")
| extend ThreatIndicator = "CVE-2024-21413-NTLM-Leak";
SuspiciousOutlookNetworkEvents
| union SuspiciousNTLMAuth
| sort by TimeGenerated descDetects potential CVE-2024-21413 exploitation by monitoring for Microsoft Outlook initiating outbound SMB connections (port 445) or NTLM authentication flows to external IPs — the hallmark of a MonikerLink click triggering covert NTLM credential capture. Also surfaces Outlook processes making unexpected external network connections.
Data Sources
Required Tables
False Positives & Tuning
- Outlook connecting to legitimate SharePoint or OneDrive file shares via SMB over the internet
- Legitimate file:// hyperlinks in emails pointing to internal UNC paths (tune with known-good internal IP ranges)
- Exchange Online hybrid connectors initiating SMB flows
Other platforms for CVE-2024-21413
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate MonikerLink click triggering external SMB auth
Expected signal: Sysmon Event ID 3 from OUTLOOK.EXE to attacker IP port 445; Windows Security Event ID 4648 with target server = attacker IP.
References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2024-21413
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1566/001/
Unlock Pro Content
Get the full detection package for CVE-2024-21413 including response playbook, investigation guide, and atomic red team tests.