CVE-2026-124194

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where RemoteIP !startswith "10."
| where RemoteIP !startswith "172.16."
| where RemoteIP !startswith "192.168."
| where RemoteIP !startswith "127."
| where RemoteIP !startswith "::1"
| where RemoteIP !in ("0.0.0.0")
| summarize count() by DeviceName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| where count_ > 5 // Adjust threshold as needed
| project DeviceName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType, count_

Splunk SPL

index=windows_events sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3 Image="*outlook.exe" DestinationIp!=10.* DestinationIp!=172.16.* DestinationIp!=192.168.* DestinationIp!=127.* DestinationIp!="::1" DestinationIp!=0.0.0.0
| stats count by ComputerName, Image, CommandLine, DestinationIp, DestinationPort, Protocol
| where count > 5 // Adjust threshold as needed

Sigma

title: Outlook Unsafe External Connection
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects Outlook making connections to external IPs without user interaction, potentially indicating CVE-2026-124194 exploitation.
author: SecBoard
date: 2026/11/10
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\OUTLOOK.EXE'
    DestinationIp|!startswith: ['10.', '172.16.', '192.168.', '127.', '::1', '0.0.0.0']
  condition: selection
falsepositives:
  - Legitimate external connections (e.g., to mail servers, cloud services). Requires tuning.
level: medium

Elastic ES|QL

from network where process.executable.name : "OUTLOOK.EXE" and not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "::1/128", "0.0.0.0/32")
| stats count() by host.name, process.command_line, destination.ip, destination.port, network.direction
| where count > 5 // Adjust threshold as needed