CVE-2024-21413.yml

name: "Microsoft Outlook RCE - CVE-2024-21413"
description: |
  Detect CVE-2024-21413 by looking for a file protocol URL with an exclamination mark (#MonikerLink Bug)
authors:
  - twitter: th3_0bel1sk
type: "rule"
severity: "critical"
source: |
  type.inbound 
  and (
    // due to the performance overhead of searching the raw html,
    // we first scan the urls, then if no url matches, we scan
    // the raw html as an extra measure
      any(body.links, regex.icontains(.href_url.url, "file://.*!"))
        or
      regex.icontains(body.html.raw, "file://.*!")
    )
    
tags:
  - "Microsoft Outlook Vulnerability"
references: 
  - "https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture"