Windows NTLM Credential Leak via File Download Interaction

// CVE-2025-24054 — Windows NTLM Credential Leak via Shell Integration Files
// Detect NTLM coercion via .library-ms, .searchConnector-ms, and similar files
// Key signals: shell processes initiating outbound SMB/WebDAV auth,
//              creation of Windows shell integration file types in user dirs
let SuspiciousShellFileCreation =
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FileName endswith_cs ".library-ms"
    or FileName endswith_cs ".searchConnector-ms"
    or FileName endswith_cs ".search-ms"
    or FileName endswith_cs ".mapimail"
| where ActionType in ("FileCreated", "FileRenamed")
| where FolderPath has_any ("Downloads", "Temp", "AppData", "Desktop")
| extend ThreatIndicator = "CVE-2025-24054-ShellFile-Drop";
let NTLMCoercionFromShell =
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "searchprotocolhost.exe",
    "searchindexer.exe", "svchost.exe")
| where RemotePort in (445, 139, 80, 443)
| where RemoteIPType == "Public"
| where InitiatingProcessCommandLine has_any ("SearchProtocolHost", "search")
    or InitiatingProcessFileName in~ ("searchprotocolhost.exe", "explorer.exe")
| extend ThreatIndicator = "CVE-2025-24054-NTLM-Coercion";
SuspiciousShellFileCreation
| union NTLMCoercionFromShell
| sort by TimeGenerated desc

index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security", "crowdstrike:events:sensor")
(
  (
    (EventCode=11 OR event_simpleName="FileCreate")
    AND (
      TargetFilename="*.library-ms" OR TargetFilename="*.searchConnector-ms"
      OR TargetFilename="*.search-ms"
    )
    AND (TargetFilename IN ("*\\Downloads\\*", "*\\Temp\\*", "*\\Desktop\\*",
                             "*\\AppData\\*"))
  )
  OR
  (
    (EventCode=3 OR event_simpleName="NetworkConnectIP4")
    AND Image IN ("*\\explorer.exe", "*\\SearchProtocolHost.exe",
                  "*\\SearchIndexer.exe")
    AND dest_port IN (445, 139, 80, 443)
    AND NOT dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1")
  )
)
| eval CVE="CVE-2025-24054"
| eval ThreatType=case(
    match(TargetFilename, "library-ms|searchConnector-ms|search-ms"), "ShellIntegration-File-Drop",
    Image="*\\SearchProtocolHost.exe", "Windows-Search-NTLM-Coercion",
    Image="*\\explorer.exe", "Explorer-NTLM-Coercion",
    true(), "Unknown"
  )
| stats count AS Events,
        values(TargetFilename) AS Files,
        values(dest_ip) AS ExternalIPs,
        values(ThreatType) AS ThreatTypes
  BY host, user, CVE, _time span=1h
| where Events >= 1
| table _time, host, user, ThreatTypes, Files, ExternalIPs, Events, CVE
| sort - Events