Windows NTLM Hash Disclosure via File Interaction (NTLMv2 Spoofing)
CVE-2024-43451 is a medium-severity (CVSS 6.5) NTLM hash disclosure spoofing vulnerability in Windows NTLMv2 authentication. The flaw is triggered when a user opens, inspects, or right-clicks a malicious file (e.g., a .url or specially crafted shortcut file) — Windows automatically initiates an NTLM authentication exchange to an attacker-controlled server, disclosing the user's NTLMv2 hash without any explicit credential entry. The vulnerability stems from CWE-73 (External Control of File Name or Path). CISA added this to the KEV catalog with a remediation deadline of December 3, 2024. NTLMv2 hashes can be cracked offline or relayed for lateral movement, making this a credential harvesting precursor especially effective in phishing and malicious email attachment campaigns.
// CVE-2024-43451 — Windows NTLM Hash Disclosure via File Interaction
// Detect outbound NTLM authentication triggered by file open/inspect actions
// Key signal: SMB or HTTP NTLM auth to external IP initiated by explorer.exe or a file handler
let SuspiciousNTLMFromExplorer =
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "svchost.exe", "rundll32.exe")
| where RemotePort in (445, 139, 80, 443)
| where RemoteIPType == "Public"
| extend ThreatIndicator = "CVE-2024-43451-NTLM-Disclosure";
let SuspiciousURLFileCreation =
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FileName endswith ".url" or FileName endswith ".lnk"
| where ActionType in ("FileCreated", "FileRenamed")
| where FolderPath has_any ("Downloads", "Temp", "AppData", "Desktop")
| extend ThreatIndicator = "CVE-2024-43451-Suspicious-URLFile";
SuspiciousNTLMFromExplorer
| union SuspiciousURLFileCreation
| sort by TimeGenerated descData Sources
Required Tables
False Positives
- Windows shell accessing legitimate network file shares via .url shortcuts (tune with internal IP allowlist)
- IT asset management tools creating .url shortcuts in user profiles
- Browser downloads of legitimate .url files from corporate intranet sites
Unlock Pro Content
Get the full detection package for CVE-2024-43451 including response playbook, investigation guide, and atomic red team tests.