Windows OLE Remote Code Execution via Malicious RTF Document

// CVE-2025-21298 — Windows OLE RCE via RTF Email Preview
// Detect suspicious process spawning from Outlook Preview Pane / OLE handling
// Key signals: OUTLOOK.EXE spawning unexpected child processes, RTF file associations
let OutlookChildProcesses =
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where FileName !in~ (
    "splwow64.exe", "winword.exe", "excel.exe", "powerpnt.exe",
    "Teams.exe", "OneDrive.exe", "SearchProtocolHost.exe",
    "msedge.exe", "MSOSYNC.EXE", "lync.exe"
  )
| where FileName !startswith "mso"
| extend ThreatIndicator = "CVE-2025-21298-Outlook-Unexpected-Child";
let OLEComponentSpawn =
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("svchost.exe", "dllhost.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe")
| where InitiatingProcessCommandLine has_any ("ole", "com", "dcom", "-Embedding")
| extend ThreatIndicator = "CVE-2025-21298-OLE-Suspicious-Child";
let SuspiciousRTFFiles =
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FileName endswith ".rtf"
| where ActionType in ("FileCreated", "FileRenamed")
| where FolderPath has_any ("Temp", "Downloads", "AppData\\Local\\Microsoft\\Windows\\INetCache")
| extend ThreatIndicator = "CVE-2025-21298-RTF-Drop";
OutlookChildProcesses
| union OLEComponentSpawn
| union SuspiciousRTFFiles
| sort by TimeGenerated desc

index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "crowdstrike:events:sensor")
(EventCode=1 OR event_simpleName="ProcessRollup2")
(
  (
    ParentImage="*\\OUTLOOK.EXE"
    AND NOT Image IN (
      "*\\splwow64.exe", "*\\winword.exe", "*\\excel.exe",
      "*\\powerpnt.exe", "*\\msedge.exe", "*\\Teams.exe"
    )
    AND NOT Image="*\\mso*.exe"
  )
  OR
  (
    ParentImage IN ("*\\dllhost.exe", "*\\svchost.exe")
    AND Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\wscript.exe",
                  "*\\cscript.exe", "*\\mshta.exe", "*\\certutil.exe")
    AND (ParentCommandLine="*-Embedding*" OR ParentCommandLine="*ole*")
  )
)
| eval CVE="CVE-2025-21298"
| eval ThreatType=case(
    ParentImage="*\\OUTLOOK.EXE", "Outlook-Unexpected-Child-Process",
    ParentImage="*\\dllhost.exe", "OLE-COM-Suspicious-Child",
    true(), "Unknown"
  )
| stats count AS ProcessEvents,
        values(Image) AS ChildProcesses,
        values(CommandLine) AS CommandLines,
        values(ParentImage) AS ParentProcesses
  BY host, user, CVE, ThreatType, _time span=1h
| where ProcessEvents >= 1
| table _time, host, user, ThreatType, ChildProcesses, CommandLines, ParentProcesses, CVE
| sort - ProcessEvents