Potential CVE-2024-21413: Outbound SMB from Outlook (Windows Event Log)

id: '28360.51640'
title: 'Potential CVE-2024-21413: Outbound SMB from Outlook'
description: A critical vulnerability CVE-2024-21413 in Microsoft Outlook, discovered
  by Check Point, enables remote code execution from merely opening an email containing
  malicious links, bypassing Outlook's Protected View. This flaw, exploitable without
  user interaction, allows attackers to perform high-privilege actions and steal NTLM
  credentials via crafted Office documents. This use case detects outbound SMB connections
  from Outlook which may indicate successful CVE-2024-21413 execution.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "<EventID>5156<")
  (TERM(445) OR TERM(SMB)) "outlook.exe" | where match(dest_port, "^445$") and match(process_name,
  "(?i)outlook\.exe") and not match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|fc00:|fd00:|fe80:)")
  | table _time, host, user, dest_ip, dest_port, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:user execution:malicious link
technique_id:
- T1204.001
data_category:
- Windows event logs
- Process use of network
references:
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/