Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Defending against CVE-2024-21413 Outlook MonikerLink Bug Abuse

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•0•66

KQL Query

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1049 - System Network Connections Discovery T1105 - Ingress Tool Transfer TA0011 - Command and Control TA0002 - Execution TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery C0036 - Pikabot Distribution February 2024 C0045 - ShadowRay C0048 - Operation MidnightEclipse T1137.003 - Outlook Forms T1137.005 - Outlook Rules T1137.004 - Outlook Home Page T1021.002 - SMB/Windows Admin Shares T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay TA0008 - Lateral Movement TA0006 - Credential Access TA0009 - Collection Network Connection Network Connection Outbound Process Event Windows Windows Defender Atp Microsoft Exchange Serverkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?