CVE-2024-21413

Sentinel/Defender KQL

EmailEvents
| where Subject contains "file:///\\" and Subject contains "!" and Subject contains ".rtf" // Beispiel für RTF-Dateien, kann erweitert werden
| where SenderFromDomain !in ("your_internal_domains.com") // Interne Kommunikation ausschließen
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, NetworkMessageId

Splunk SPL

index=email (subject="file:///\\*!*" AND subject="*.rtf") NOT (sender_domain="your_internal_domains.com") | table _time, sender_address, recipient_address, subject

Sigma

title: CVE-2024-21413 MonikerLink Outlook Exploit Attempt
status: experimental
description: Detects attempts to exploit CVE-2024-21413 (MonikerLink) in Microsoft Outlook via crafted file:// links.
author: SecBoard
date: 2024/02/14
logsource:
  category: email
  product: office365
detection:
  selection:
    Subject|contains_all:
      - 'file:///\\'
      - '!'
      - '.rtf' # Example, can be expanded
  condition: selection
falsepositives:
  - Legitimate use of file:// links with '!' (unlikely in this context)
level: high

Elastic ES|QL

from email_logs
| where subject : "file:///\\*!*" and subject : "*.rtf"
| where not sender_domain : "your_internal_domains.com"
| select @timestamp, sender_address, recipient_address, subject