Detect Windows NTLM Hash Disclosure via File Interaction (NTLMv2 Spoofing) in Microsoft Sentinel
CVE-2024-43451 is a medium-severity (CVSS 6.5) NTLM hash disclosure spoofing vulnerability in Windows NTLMv2 authentication. The flaw is triggered when a user opens, inspects, or right-clicks a malicious file (e.g., a .url or specially crafted shortcut file) — Windows automatically initiates an NTLM authentication exchange to an attacker-controlled server, disclosing the user's NTLMv2 hash without any explicit credential entry. The vulnerability stems from CWE-73 (External Control of File Name or Path). CISA added this to the KEV catalog with a remediation deadline of December 3, 2024. NTLMv2 hashes can be cracked offline or relayed for lateral movement, making this a credential harvesting precursor especially effective in phishing and malicious email attachment campaigns.
MITRE ATT&CK
- Tactic
- Credential Access Initial Access
KQL Detection Query
// CVE-2024-43451 — Windows NTLM Hash Disclosure via File Interaction
// Detect outbound NTLM authentication triggered by file open/inspect actions
// Key signal: SMB or HTTP NTLM auth to external IP initiated by explorer.exe or a file handler
let SuspiciousNTLMFromExplorer =
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "svchost.exe", "rundll32.exe")
| where RemotePort in (445, 139, 80, 443)
| where RemoteIPType == "Public"
| extend ThreatIndicator = "CVE-2024-43451-NTLM-Disclosure";
let SuspiciousURLFileCreation =
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FileName endswith ".url" or FileName endswith ".lnk"
| where ActionType in ("FileCreated", "FileRenamed")
| where FolderPath has_any ("Downloads", "Temp", "AppData", "Desktop")
| extend ThreatIndicator = "CVE-2024-43451-Suspicious-URLFile";
SuspiciousNTLMFromExplorer
| union SuspiciousURLFileCreation
| sort by TimeGenerated descDetects CVE-2024-43451 exploitation indicators: outbound SMB/HTTP connections from explorer.exe or shell handlers to external IPs (NTLM coercion), and creation of .url or .lnk files in user-accessible paths (delivery mechanism). Correlate both events on the same host within a short time window for high-confidence alerts.
Data Sources
Required Tables
False Positives & Tuning
- Windows shell accessing legitimate network file shares via .url shortcuts (tune with internal IP allowlist)
- IT asset management tools creating .url shortcuts in user profiles
- Browser downloads of legitimate .url files from corporate intranet sites
Other platforms for CVE-2024-43451
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create malicious .url file triggering NTLM auth on open
Expected signal: Sysmon Event ID 3 from explorer.exe to attacker IP:445; Event ID 4648 showing NTLM auth attempt.
Unlock Pro Content
Get the full detection package for CVE-2024-43451 including response playbook, investigation guide, and atomic red team tests.