Windows NTLM Credential Leak via File Download Interaction

union DeviceNetworkEvents, DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("NetworkConnectionRequested", "ConnectionSuccess", "ConnectionFailed")
    or ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".library-ms" or FileName endswith ".url" or FileName endswith ".lnk" or FileName endswith ".scf"
    or (RemotePort == 445 or RemotePort == 139)
| extend FileExt = tostring(split(FileName, ".")[-1])
| where InitiatingProcessFileName in~ ("explorer.exe", "svchost.exe", "rundll32.exe")
    or InitiatingProcessParentFileName in~ ("explorer.exe")
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort in (445, 139)
    | where InitiatingProcessFileName in~ ("lsass.exe", "svchost.exe", "explorer.exe")
    | where ActionType == "ConnectionSuccess"
    | project DeviceId, NetworkTimestamp=Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName
) on DeviceId
| where abs(datetime_diff('second', Timestamp, NetworkTimestamp)) < 30
| where not(ipv4_is_private(RemoteIP)) or RemoteIP !startswith "10." and RemoteIP !startswith "192.168."
| summarize count(), FileNames=make_set(FileName), RemoteIPs=make_set(RemoteIP) by DeviceId, DeviceName, bin(Timestamp, 5m)
| where count_ >= 1
| project Timestamp, DeviceName, DeviceId, FileNames, RemoteIPs, EventCount=count_

index=windows (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval event_id=coalesce(EventCode, event_id)
| where event_id IN ("3", "11", "4624", "4625", "4648")
| eval file_ext=lower(mvindex(split(FileName, "."), -1))
| eval suspicious_file=if(match(FileName, "(?i)\.(library-ms|url|lnk|scf)$"), 1, 0)
| eval smb_connection=if(event_id="3" AND (DestinationPort="445" OR DestinationPort="139"), 1, 0)
| eval ntlm_auth=if(event_id IN ("4624","4625","4648") AND AuthenticationPackageName="NTLM", 1, 0)
| eval initiating_proc=lower(coalesce(ParentImage, ProcessName, InitiatingProcessName))
| where suspicious_file=1 OR smb_connection=1 OR ntlm_auth=1
| eval host_key=coalesce(ComputerName, host)
| bin _time span=2m
| stats sum(suspicious_file) as file_hits, sum(smb_connection) as smb_hits, sum(ntlm_auth) as ntlm_hits, values(DestinationIp) as dest_ips, values(FileName) as files_seen, values(SubjectUserName) as users by _time, host_key
| where file_hits>=1 AND smb_hits>=1
| eval risk_score=if(ntlm_hits>=1, "HIGH", "MEDIUM")
| table _time, host_key, users, files_seen, dest_ips, file_hits, smb_hits, ntlm_hits, risk_score

sequence by host.id with maxspan=30s
  [file where event.action in ("creation", "modification") and
   file.extension in ("library-ms", "url", "lnk", "scf") and
   process.name in ("explorer.exe", "svchost.exe", "chrome.exe", "msedge.exe", "firefox.exe")]
  [network where event.action == "connection_attempted" and
   destination.port in (445, 139) and
   process.name in ("explorer.exe", "svchost.exe", "lsass.exe") and
   not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  destinationip,
  destinationport,
  username,
  QIDNAME(qid) AS event_name,
  TEXT(payload) AS raw_payload
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Sysmon')
  AND (
    (LOWER(TEXT(payload)) LIKE '%.library-ms%' OR LOWER(TEXT(payload)) LIKE '%.lnk%'
     OR LOWER(TEXT(payload)) LIKE '%.url%' OR LOWER(TEXT(payload)) LIKE '%.scf%')
    OR (destinationport IN (445, 139) AND eventid IN (5156, 5158, 3))
    OR (eventid IN (4624, 4625, 4648) AND LOWER(TEXT(payload)) LIKE '%ntlm%')
  )
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=Windows/Security OR _sourceCategory=Windows/Sysmon
| parse regex "(?i)(?P<filename>[\w\-\.]+\.(?:library-ms|url|lnk|scf))" nodrop
| parse regex "DestinationPort=(?P<dest_port>\d+)" nodrop
| parse regex "DestinationIp=(?P<dest_ip>[\d\.]+)" nodrop
| parse regex "AuthenticationPackageName=(?P<auth_package>[^\r\n]+)" nodrop
| parse regex "SubjectUserName=(?P<username>[^\r\n]+)" nodrop
| where filename matches "*.library-ms" or filename matches "*.url" or filename matches "*.lnk" or filename matches "*.scf"
    or (dest_port = "445" or dest_port = "139")
    or (auth_package = "NTLM")
| eval is_suspicious_file = if(!isNull(filename), 1, 0)
| eval is_smb_connection = if(dest_port in ("445", "139"), 1, 0)
| eval is_ntlm = if(auth_package = "NTLM", 1, 0)
| timeslice 2m
| stats sum(is_suspicious_file) as file_events, sum(is_smb_connection) as smb_events, sum(is_ntlm) as ntlm_events, values(filename) as files, values(dest_ip) as dest_ips, values(username) as users by _timeslice, _sourceHost
| where file_events >= 1 and smb_events >= 1
| sort by _timeslice desc

rule cve_2025_24054_ntlm_credential_leak {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-24054 NTLM credential leakage via crafted file interaction triggering outbound SMB authentication"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054"
    cve = "CVE-2025-24054"

  events:
    $file_event.metadata.event_type = "FILE_CREATION"
    $file_event.target.file.full_path = /(?i)\.(library-ms|url|lnk|scf)$/
    $file_event.principal.hostname = $hostname
    $file_event.principal.process.file.full_path = /(?i)(explorer|svchost|chrome|msedge|firefox)\.exe$/

    $network_event.metadata.event_type = "NETWORK_CONNECTION"
    $network_event.target.port = 445
    $network_event.principal.hostname = $hostname
    $network_event.target.ip != "10.0.0.0/8"
    $network_event.target.ip != "172.16.0.0/12"
    $network_event.target.ip != "192.168.0.0/16"

  match:
    $hostname over 30s

  condition:
    $file_event and $network_event
}

#event_simpleName=NetworkConnectIP4
| event_platform=Win
| RemotePort IN (445, 139)
| NOT RemoteAddressIP4 IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1")
| FileName IN ("explorer.exe", "svchost.exe")
| join type=inner (
    #event_simpleName=FileOpenInfo
    | event_platform=Win
    | TargetFileName=/(?i)\.(library-ms|url|lnk|scf)$/
    | fields aid, ContextTimeStamp, TargetFileName, UserName
  ) by aid
| eval time_delta = NetworkConnectTimestamp - ContextTimeStamp
| where time_delta >= 0 AND time_delta <= 30
| stats count() as connection_count, values(RemoteAddressIP4) as remote_ips, values(TargetFileName) as trigger_files, values(UserName) as affected_users by aid, ComputerName, bin(NetworkConnectTimestamp, 5m)
| where connection_count >= 1
| sort -NetworkConnectTimestamp