YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24

Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook

ExploitSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: X__Junior, Florian Roth
Date: 2024-02-17
Modified: 2024-02-19
Score / Quality: 75 / 85

What this rule detects

Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook

It defines 3 patterns (2 text, 0 hex, 1 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

expl-cve-2024-21413-microsoft-outlook-rce-feb24.yarDetection Rule License 1.1

rule SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 : CVE_2024_21413 FILE
{
	meta:
		description = "Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook"
		author = "X__Junior, Florian Roth"
		id = "4512ca7b-0755-565e-84f1-596552949aa5"
		date = "2024-02-17"
		modified = "2024-02-19"
		reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_outlook_cve_2024_21413.yar#L2-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "06cfafe0b92949e493dca6d54f671d0607242d97341144b69f563a0cc24dc6a1"
		score = 75
		quality = 85
		tags = "CVE-2024-21413, FILE"

	strings:
		$a1 = "Subject: "
		$a2 = "Received: "
		$xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/

	condition:
		filesize < 1000KB and all of ( $a* ) and 1 of ( $xr* )
}

Strings (3 patterns)

Identifier	Type	Value
$a1	text	"Subject: "
$a2	text	"Received: "
$xr1	regex	/file:\/\/\/\\\\[^"']{6,600}\.(docx\|txt\|pdf\|xlsx\|pptx\|odt\|etc\|jpg\|png\|gif\|bmp\|tiff\|svg\|mp4\|avi\|mov\|wmv\|flv\|mkv\|mp3\|wav\|aac\|flac\|ogg\|wma\|exe\|msi\|bat\|cmd\|ps1\|zip\| …

Condition

filesize < 1000KB and all of ( $a* ) and 1 of ( $xr* )

In plain words (Heuristic)

The file must be smaller than 1000KB (a cheap guard that skips large files).
All patterns in ( $a* ) must match.
At least 1 patterns in ( $xr* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/

Licence & attribution

Author: X__Junior, Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4512ca7b-0755-565e-84f1-596552949aa5

Tags:CVE_2024_21413 FILE