This rule detects messages containing links exploiting CVE-2024-21413, which can lead to RCE.

Successful exploitation can bypass built-in Outlook protections for malicious links embedded in messages by using the file:// protocol and an exclamation mark to URLs pointing to attacker-controlled servers."

Read More