Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2024-43451.
Upgrade to ProDetect CVE-2024-43451: Windows NTLM Hash Disclosure via File Interaction in Splunk
CVE-2024-43451 is a Windows NTLM hash disclosure vulnerability (NTLMv2 spoofing) affecting Windows 10, Windows 11, and Windows Server 2008-2025. Minimal user interaction with a malicious file (right-click, open, or preview) triggers an outbound NTLM authentication request to an attacker-controlled server, leaking the victim's NTLMv2 hash. The hash can be cracked offline or used in relay attacks. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
SPL Detection Query
index=windows OR index=network sourcetype IN (XmlWinEventLog:Security, WinEventLog:Security, stream:smb, pan:traffic)
| eval event_time=_time
| search (EventCode=4648 OR EventCode=4624 OR dest_port=445 OR dest_port=139)
| eval is_external=if(match(dest_ip, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\.168\.)"), 0, 1)
| where is_external=1
| join type=inner max=0 dest_host [
search index=windows sourcetype=WinEventLog:Security EventCode=4688
| eval suspicious_file=if(match(CommandLine, "\\.(url|lnk|scf|library-ms|searchConnector-ms)"), 1, 0)
| where suspicious_file=1
| fields dest_host, CommandLine, NewProcessName, SubjectUserName
]
| stats count as event_count, values(CommandLine) as commands, values(dest_ip) as dest_ips, values(NewProcessName) as processes by dest_host, SubjectUserName, sourcetype
| where event_count > 0
| eval risk_score=case(event_count > 5, "critical", event_count > 2, "high", true(), "medium")
| table _time, dest_host, SubjectUserName, dest_ips, commands, processes, event_count, risk_scoreCorrelates Windows Security Event Log process creation events involving suspicious file types (.url, .lnk, .scf) with outbound SMB connections to external IP addresses, indicating potential NTLM hash disclosure via CVE-2024-43451.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Users legitimately accessing external SMB shares (rare but possible in some enterprise environments)
- Security scanning tools that open or enumerate .lnk and .url files
- Software deployment systems interacting with shortcut files and making outbound connections
- VPN split-tunneling scenarios where internal IPs appear as external from the SIEM perspective
Other platforms for CVE-2024-43451
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1NTLM Hash Disclosure via Malicious .url File
Expected signal: Sysmon EventID 11 (file creation for .url file), Sysmon EventID 3 (network connection from explorer.exe to ATTACKER_IP:445), Windows Security EventID 4648 (explicit credential use targeting ATTACKER_IP), Responder captures NTLMv2 hash
- Test 2NTLM Hash Disclosure via Malicious .lnk Shortcut
Expected signal: Sysmon EventID 11 (LNK creation), Sysmon EventID 3 (explorer.exe → ATTACKER_IP:445), Windows Security EventID 4648 with LogonType=3 and TargetServerName=ATTACKER_IP
- Test 3NTLM Hash Disclosure via Malicious .scf (Shell Command File)
Expected signal: Sysmon EventID 3 from explorer.exe to ATTACKER_IP:445 without any explicit user action beyond folder view, Windows Security EventID 4648 capturing NTLMv2 exchange, network PCAP showing full NTLM handshake
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2024-43451 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month