CVE-2024-43451: Windows NTLM Hash Disclosure via File Interaction

let suspiciousExtensions = dynamic(['.url', '.lnk', '.scf', '.library-ms', '.searchConnector-ms']);
let internalSubnets = dynamic(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16']);
union DeviceNetworkEvents, imNetworkSession
| where TimeGenerated >= ago(24h)
| where RemotePort == 445 or RemotePort == 139
| where not(ipv4_is_private(RemoteIPv4))
| join kind=inner (
    DeviceFileEvents
    | where TimeGenerated >= ago(24h)
    | where FileName has_any (suspiciousExtensions)
    | project DeviceId, FileEventTime=TimeGenerated, FileName, FolderPath, InitiatingProcessFileName
) on DeviceId
| where abs(datetime_diff('second', TimeGenerated, FileEventTime)) < 30
| project TimeGenerated, DeviceId, DeviceName, RemoteIPv4, RemotePort, FileName, FolderPath, InitiatingProcessFileName
| summarize EventCount=count(), Files=make_set(FileName), RemoteIPs=make_set(RemoteIPv4) by bin(TimeGenerated, 5m), DeviceName, InitiatingProcessFileName

index=windows OR index=network sourcetype IN (XmlWinEventLog:Security, WinEventLog:Security, stream:smb, pan:traffic)
| eval event_time=_time
| search (EventCode=4648 OR EventCode=4624 OR dest_port=445 OR dest_port=139)
| eval is_external=if(match(dest_ip, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\.168\.)"), 0, 1)
| where is_external=1
| join type=inner max=0 dest_host [
    search index=windows sourcetype=WinEventLog:Security EventCode=4688
    | eval suspicious_file=if(match(CommandLine, "\\.(url|lnk|scf|library-ms|searchConnector-ms)"), 1, 0)
    | where suspicious_file=1
    | fields dest_host, CommandLine, NewProcessName, SubjectUserName
]
| stats count as event_count, values(CommandLine) as commands, values(dest_ip) as dest_ips, values(NewProcessName) as processes by dest_host, SubjectUserName, sourcetype
| where event_count > 0
| eval risk_score=case(event_count > 5, "critical", event_count > 2, "high", true(), "medium")
| table _time, dest_host, SubjectUserName, dest_ips, commands, processes, event_count, risk_score

sequence by host.id with maxspan=30s
  [file where event.action in ("open", "creation", "access") and
   file.extension in ("url", "lnk", "scf", "library-ms", "searchConnector-ms") and
   not file.path like~ "C:\\Windows\\*"]
  [network where event.action == "connection_attempted" and
   destination.port in (445, 139) and
   not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "::1/128")]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  CATEGORYNAME(category) AS event_category,
  "QID" AS qid,
  LOGSOURCENAME(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (category = 5156 OR category = 5158 OR destinationport IN (445, 139))
    AND NOT INCIDR(destinationip, '10.0.0.0/8')
    AND NOT INCIDR(destinationip, '172.16.0.0/12')
    AND NOT INCIDR(destinationip, '192.168.0.0/16')
    AND NOT INCIDR(destinationip, '127.0.0.0/8')
  )
  AND username IN (
    SELECT username FROM events
    WHERE
      LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
      AND LONG("Malicious File Extension") = 1
      AND devicetime BETWEEN (NOW() - 30 SECONDS) AND NOW()
  )
  AND devicetime >= NOW() - HOURS 24
GROUP BY sourceip, destinationip, destinationport, username
ORDER BY event_time DESC
LIMIT 500

_sourceCategory=windows/security OR _sourceCategory=windows/sysmon
| where EventID in ("4648", "4624", "5156", "4688")
| if (EventID == "4688", CommandLine, "") as process_cmd
| if (matches(process_cmd, "(?i)\.(url|lnk|scf|library-ms|searchConnector-ms)"), 1, 0) as suspicious_file_access
| if (EventID in ("5156", "4648"), DestAddress, "") as dest_ip
| where dest_ip != ""
| where !matches(dest_ip, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\.168\.)") and dest_ip != "127.0.0.1"
| timeslice 5m
| stats count as connection_count, count_distinct(dest_ip) as unique_ext_ips, max(suspicious_file_access) as had_suspicious_file by _timeslice, Computer, SubjectUserName
| where connection_count > 0 and had_suspicious_file == 1
| sort by _timeslice desc

rule cve_2024_43451_ntlm_hash_disclosure {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects NTLM hash disclosure via malicious file interaction (CVE-2024-43451)"
    severity = "HIGH"
    confidence = "HIGH"
    cve = "CVE-2024-43451"
    mitre_attack = "T1187"

  events:
    $file_event.metadata.event_type = "FILE_OPEN"
    $file_event.target.file.full_path = /\.(url|lnk|scf|library-ms|searchConnector-ms)$/i nocase
    $file_event.principal.hostname = $host

    $net_event.metadata.event_type = "NETWORK_CONNECTION"
    $net_event.network.application_protocol = "SMB"
    $net_event.target.port = 445
    not $net_event.target.ip = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
    $net_event.principal.hostname = $host

  match:
    $host over 30s

  condition:
    $file_event and $net_event
}

#event_simpleName IN ("NetworkConnectIP4", "ProcessRollup2", "FileOpenInfo")
| FileOpenInfo.FileName = /\.(url|lnk|scf|library-ms|searchConnector-ms)$/i
| event_simpleName = "NetworkConnectIP4"
| RemotePort IN (445, 139)
| NOT RemoteIP = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
| join type=inner [
    #event_simpleName = "FileOpenInfo"
    | FileOpenInfo.FileName = /\.(url|lnk|scf|library-ms|searchConnector-ms)$/i
    | fields aid, FileOpenInfo.FileName, ContextProcessId
] where aid=aid AND timestamp_diff(timestamp, FileOpenInfo.timestamp) < 30
| stats count() as smb_connection_count, values(RemoteIP) as remote_ips, values(FileOpenInfo.FileName) as trigger_files by aid, LocalAddressIP4, UserName
| sort smb_connection_count desc