Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2024-21413.
Upgrade to ProDetect CVE-2024-21413: Microsoft Outlook RCE via Moniker Link (MonikerLink) in Splunk
CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook caused by improper input validation of hyperlinks using the 'file://' moniker protocol combined with an exclamation mark suffix. When a victim previews or opens a crafted email, Outlook follows the malicious link without the usual Protected View warning, leaking NTLM credentials via an outbound SMB connection and potentially enabling remote code execution. CVSS 9.8. Actively exploited in the wild (CISA KEV).
MITRE ATT&CK
SPL Detection Query
index=* sourcetype IN ("ms:o365:reporting:messagetrace", "ms:defender:atp:devicenetworkevents", "ms:defender:atp:deviceprocessevents", "ms:o365:defender:emailurlinfo")
| eval is_moniker_url=if(match(url, "(?i)file://[^\s]*![^\s]*"), 1, 0),
is_outlook_smb=if((sourcetype="ms:defender:atp:devicenetworkevents" AND (RemotePort=445 OR RemotePort=139) AND match(InitiatingProcessFileName, "(?i)outlook\.exe")), 1, 0),
is_outlook_child=if((sourcetype="ms:defender:atp:deviceprocessevents" AND match(InitiatingProcessFileName, "(?i)outlook\.exe") AND match(FileName, "(?i)(cmd|powershell|wscript|mshta|rundll32|regsvr32)\.exe")), 1, 0)
| where is_moniker_url=1 OR is_outlook_smb=1 OR is_outlook_child=1
| eval detection_source=case(is_moniker_url=1, "MonikerURLInEmail", is_outlook_smb=1, "OutlookSMBEgress", is_outlook_child=1, "OutlookChildProcess", true(), "unknown")
| table _time, host, user, url, RemoteIP, RemotePort, InitiatingProcessFileName, FileName, ProcessCommandLine, detection_source
| sort -_timeDetects CVE-2024-21413 exploitation across three signal types: file:// moniker URLs in emails, Outlook-initiated SMB egress (credential theft), and Outlook spawning suspicious child processes (RCE).
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate UNC file:// paths sent internally via email for document sharing
- IT automation tools that spawn processes under Outlook context
- SMB traffic from Outlook accessing enterprise document management systems
- Security awareness testing platforms that send test phishing emails containing file:// links
Other platforms for CVE-2024-21413
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1MonikerLink NTLM Credential Capture via Crafted Email
Expected signal: Windows Security Event ID 4776 on DC showing NTLM authentication from victim Outlook host to ATTACKER_IP. Sysmon Event ID 3 showing OUTLOOK.EXE network connection to ATTACKER_IP:445.
- Test 2Outlook Child Process Spawn via MonikerLink RCE Simulation
Expected signal: Sysmon Event ID 1 with ParentImage=OUTLOOK.EXE and Image=calc.exe (or substitute payload). DeviceProcessEvents in Defender ATP showing the process chain.
- Test 3MonikerLink Pattern Extraction and Email Header Analysis
Expected signal: Microsoft Defender for Office 365 EmailUrlInfo table entry with Url matching file://[IP]/[share]/[path]![suffix] pattern. Log ingestion into SIEM within 5-15 minutes.
- Test 4NTLM Hash Relay Attempt Post-Credential Capture
Expected signal: Windows Security Event ID 4624 (Type 3 network logon) on lab target using relayed credentials. Sysmon network events showing SMB connection from relay host to target. New process execution on target if relay succeeded.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2024-21413 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month