Detect Windows NTLM Hash Disclosure via File Interaction (NTLMv2 Spoofing) in Splunk
CVE-2024-43451 is a medium-severity (CVSS 6.5) NTLM hash disclosure spoofing vulnerability in Windows NTLMv2 authentication. The flaw is triggered when a user opens, inspects, or right-clicks a malicious file (e.g., a .url or specially crafted shortcut file) — Windows automatically initiates an NTLM authentication exchange to an attacker-controlled server, disclosing the user's NTLMv2 hash without any explicit credential entry. The vulnerability stems from CWE-73 (External Control of File Name or Path). CISA added this to the KEV catalog with a remediation deadline of December 3, 2024. NTLMv2 hashes can be cracked offline or relayed for lateral movement, making this a credential harvesting precursor especially effective in phishing and malicious email attachment campaigns.
MITRE ATT&CK
- Tactic
- Credential Access Initial Access
SPL Detection Query
index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security", "crowdstrike:events:sensor")
(
(
(EventCode=3 OR event_simpleName="NetworkConnectIP4")
AND (Image IN ("*\\explorer.exe", "*\\rundll32.exe") OR process_name IN ("explorer.exe", "rundll32.exe"))
AND dest_port IN (445, 139, 80, 443)
AND NOT dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1")
)
OR
(
(EventCode=11 OR event_simpleName="FileCreate")
AND (TargetFilename="*.url" OR TargetFilename="*.lnk")
AND (TargetFilename IN ("*\\Downloads\\*", "*\\Temp\\*", "*\\Desktop\\*"))
)
)
| eval CVE="CVE-2024-43451"
| eval ThreatType=if(dest_port IN (445,139), "NTLM-Coercion-SMB", if(dest_port IN (80,443), "NTLM-Coercion-HTTP", "URLFile-Drop"))
| stats count AS Events,
values(dest_ip) AS ExternalIPs,
values(TargetFilename) AS Files,
values(ThreatType) AS ThreatTypes
BY host, user, CVE, span=1h _time
| where Events >= 1
| table _time, host, user, Events, ExternalIPs, Files, ThreatTypes, CVE
| sort - EventsDetects CVE-2024-43451 exploitation by monitoring for (1) explorer.exe/rundll32.exe initiating outbound SMB/HTTP connections to external IPs, and (2) .url or .lnk files being created in user download paths. Correlate both event types on the same host for higher-confidence detections.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate .url shortcuts created by enterprise software installers
- Windows shell connecting to internal file servers (exclude RFC1918 IPs)
Other platforms for CVE-2024-43451
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create malicious .url file triggering NTLM auth on open
Expected signal: Sysmon Event ID 3 from explorer.exe to attacker IP:445; Event ID 4648 showing NTLM auth attempt.
Unlock Pro Content
Get the full detection package for CVE-2024-43451 including response playbook, investigation guide, and atomic red team tests.