Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2025-24054.
Upgrade to ProDetect Windows NTLM Credential Leak via File Download Interaction in Splunk
CVE-2025-24054 is a Windows NTLM hash disclosure vulnerability triggered when a user interacts with a specially crafted file (e.g., .library-ms, .url, .lnk) that forces an outbound NTLM authentication attempt to an attacker-controlled server. Exploitation requires minimal user interaction — simply downloading or viewing a malicious file in Explorer can suffice. The leaked Net-NTLMv2 hash can be cracked offline or relayed for lateral movement. This vulnerability is actively exploited in the wild and listed in CISA's KEV catalog.
MITRE ATT&CK
SPL Detection Query
index=windows (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval event_id=coalesce(EventCode, event_id)
| where event_id IN ("3", "11", "4624", "4625", "4648")
| eval file_ext=lower(mvindex(split(FileName, "."), -1))
| eval suspicious_file=if(match(FileName, "(?i)\.(library-ms|url|lnk|scf)$"), 1, 0)
| eval smb_connection=if(event_id="3" AND (DestinationPort="445" OR DestinationPort="139"), 1, 0)
| eval ntlm_auth=if(event_id IN ("4624","4625","4648") AND AuthenticationPackageName="NTLM", 1, 0)
| eval initiating_proc=lower(coalesce(ParentImage, ProcessName, InitiatingProcessName))
| where suspicious_file=1 OR smb_connection=1 OR ntlm_auth=1
| eval host_key=coalesce(ComputerName, host)
| bin _time span=2m
| stats sum(suspicious_file) as file_hits, sum(smb_connection) as smb_hits, sum(ntlm_auth) as ntlm_hits, values(DestinationIp) as dest_ips, values(FileName) as files_seen, values(SubjectUserName) as users by _time, host_key
| where file_hits>=1 AND smb_hits>=1
| eval risk_score=if(ntlm_hits>=1, "HIGH", "MEDIUM")
| table _time, host_key, users, files_seen, dest_ips, file_hits, smb_hits, ntlm_hits, risk_scoreCorrelates Sysmon file creation events for crafted file types (.library-ms, .url, .lnk, .scf) with outbound SMB network connections and NTLM authentication events within a 2-minute window, indicating potential CVE-2025-24054 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate mapped network drives accessed via .lnk shortcut files on domain workstations
- Help desk or IT tooling distributing .url files pointing to internal SMB shares
- Group Policy processing that creates .library-ms files during logon scripts
- Third-party software installers creating shell link (.lnk) files to network resources
Other platforms for CVE-2025-24054
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1NTLM Credential Leak via Malicious .library-ms File
Expected signal: Sysmon Event ID 11 (FileCreate) for TestLib.library-ms; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445; Windows Security Event ID 4648 showing NTLM authentication attempt to ATTACKER_IP
- Test 2NTLM Credential Leak via Crafted .url Shortcut File
Expected signal: Sysmon Event ID 11 (FileCreate) for Important-Document.url on Desktop; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445; Windows Security Event ID 4625 if auth fails (Responder returns failure after capture)
- Test 3Net-NTLMv2 Hash Offline Cracking Simulation Post-Capture
Expected signal: On Windows DC (if auth attempted with cracked hash): Windows Security Event ID 4624 (successful logon) or 4625 (failed logon) with NTLM authentication from unexpected source IP; Kerberos fallback to NTLM is itself anomalous for modern AD environments
- Test 4NTLM Credential Leak via Crafted .scf File in Shared Folder
Expected signal: Sysmon Event ID 11 (FileCreate) for @trigger.scf; Sysmon Event ID 3 (NetworkConnect) from explorer.exe to ATTACKER_IP:445 triggered by shell icon resolution; Windows Security audit log showing NTLM authentication to external host
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2025-24054 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month