Detect Microsoft Outlook RCE via Moniker Link (MonikerLink) in Splunk
CVE-2024-21413 is a critical (CVSS 9.8) remote code execution vulnerability in Microsoft Outlook caused by improper input validation. Dubbed 'MonikerLink', the flaw allows an attacker to craft a malicious hyperlink using the file:// URI scheme combined with an exclamation mark (!), bypassing Outlook's Protected View and MOTW (Mark of the Web) safeguards. When a user clicks the link, Outlook resolves it as a Component Object Model (COM) moniker, triggering NTLM authentication negotiation to an attacker-controlled server (leaking NTLMv2 hashes) and potentially executing arbitrary code. Affected products include Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, and Office LTSC 2021. CISA added this to the KEV catalog with a due date of February 27, 2025, indicating active exploitation in the wild.
MITRE ATT&CK
- Tactic
- Initial Access Execution
SPL Detection Query
index=endpoint sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "crowdstrike:events:sensor")
(
(EventCode=3 OR event_simpleName="NetworkConnectIP4")
AND (Image="*\\OUTLOOK.EXE" OR ParentImage="*\\OUTLOOK.EXE" OR process_name="OUTLOOK.EXE")
AND dest_port IN (445, 139)
AND NOT (dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1"))
)
| eval CVE="CVE-2024-21413"
| eval ThreatType="Outlook-MonikerLink-NTLM-Leak"
| stats count AS OutboundSMBAttempts,
values(dest_ip) AS ExternalIPs,
values(dest_port) AS Ports,
dc(dest_ip) AS UniqueExternalIPs
BY host, user, CVE, ThreatType, span=1h _time
| where OutboundSMBAttempts >= 1
| eval Severity="CRITICAL"
| table _time, host, user, ExternalIPs, Ports, OutboundSMBAttempts, UniqueExternalIPs, CVE, Severity, ThreatType
| sort - OutboundSMBAttemptsDetects CVE-2024-21413 exploitation by identifying Outlook.exe initiating outbound SMB connections (port 445/139) to external, non-RFC1918 IP addresses. This pattern indicates a MonikerLink click that triggered NTLM authentication to an attacker-controlled server for credential harvesting.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Outlook accessing legitimate internal file servers via SMB (exclude RFC1918 ranges)
- Email clients opening UNC path hyperlinks to sanctioned internal resources
Other platforms for CVE-2024-21413
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate MonikerLink click triggering external SMB auth
Expected signal: Sysmon Event ID 3 from OUTLOOK.EXE to attacker IP port 445; Windows Security Event ID 4648 with target server = attacker IP.
References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2024-21413
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1566/001/
Unlock Pro Content
Get the full detection package for CVE-2024-21413 including response playbook, investigation guide, and atomic red team tests.