Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest.
Upgrade to ProEmail Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes
Rather than delivering an executable payload, actors such as TA577 email a ZIP attachment containing an HTML file (or, in earlier waves, a direct .url/.search-ms file) whose sole purpose is to reference a remote UNC path (e.g. \\attacker-server\share\file). When the victim opens the attachment, Windows automatically attempts SMB authentication to the attacker-controlled server to resolve the path — leaking the user's NetNTLMv2 challenge-response hash over the wire without ever executing malicious code on the endpoint. The captured hash is then cracked offline or relayed (NTLM relay) to gain credentials or a foothold. Because no payload runs and no persistence is established, this is reconnaissance/information-gathering via a phishing lure (T1598.002 — Phishing for Information: Spearphishing Attachment) rather than a delivery mechanism for malware; the objective is purely to elicit authentication material from the target. Detection focuses on the anomaly that outbound SMB (ports 445/139) is almost never legitimate when it originates from a user-facing application (browser, archive utility, Office app, or Explorer) and targets a public, non-RFC1918 IP address, especially when that connection follows shortly after a ZIP/HTML/ISO attachment was delivered to the same mailbox.
What is THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes?
Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes (THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest) maps to the Reconnaissance tactic — the adversary is trying to gather information they can use to plan future operations in MITRE ATT&CK.
This page provides production-ready detection logic for Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint (DeviceNetworkEvents), Microsoft Defender for Office 365 (EmailAttachmentInfo), Sysmon Event ID 3. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Reconnaissance
// THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest (T1598.002) - Attachment forces outbound SMB auth to harvest NTLM hashes
let SuspiciousInitiators = dynamic(["explorer.exe", "iexplore.exe", "msedge.exe", "chrome.exe", "firefox.exe",
"WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "7zFM.exe", "WinRAR.exe", "Notepad.exe"]);
// Pillar 1: outbound SMB (445/139) from a user-facing app to a public (non-RFC1918) IP
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (445, 139)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName in~ (SuspiciousInitiators)
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")
or ipv4_is_in_range(RemoteIP, "172.16.0.0/12")
or ipv4_is_in_range(RemoteIP, "192.168.0.0/16")
or ipv4_is_in_range(RemoteIP, "169.254.0.0/16")
or ipv4_is_in_range(RemoteIP, "127.0.0.0/8"))
| extend SuspicionReason = "OutboundSMBToPublicIPFromUserApp"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, InitiatingProcessFileName,
RemoteIP, RemotePort, SuspicionReason
| union (
// Pillar 2: ZIP/HTML/ISO attachment delivered, followed by outbound SMB from the same recipient within 60 minutes
let RiskyAttachments = EmailAttachmentInfo
| where Timestamp > ago(24h)
| where FileType in~ ("zip", "html", "htm", "iso", "img")
| project DeliveryTime=Timestamp, RecipientEmailAddress, FileName, SenderFromAddress;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (445, 139)
| where ActionType == "ConnectionSuccess"
| extend RecipientEmailAddress = InitiatingProcessAccountUpn
| join kind=inner RiskyAttachments on RecipientEmailAddress
| where datetime_diff('minute', Timestamp, DeliveryTime) between (0 .. 60)
| extend SuspicionReason = "AttachmentDeliveryFollowedByOutboundSMB"
| project Timestamp, DeviceName, AccountName=RecipientEmailAddress, InitiatingProcessFileName,
RemoteIP, RemotePort, SuspicionReason
)
| sort by Timestamp descTwo-pillar detection for attachment-driven forced SMB authentication used to harvest NTLM hashes. Pillar 1 flags any outbound SMB (445/139) connection made by a user-facing process (browser, Office app, archive utility, Explorer) to a public IP — legitimate SMB traffic is virtually always intra-network, so this alone is a strong anomaly. Pillar 2 narrows to cases where a ZIP/HTML/ISO attachment was delivered to the same mailbox within the prior 60 minutes, tightening the correlation to the specific attachment-triggered forced-auth pattern documented in TA577 campaigns.
Data Sources
Required Tables
False Positives
- VPN or SD-WAN split-tunnel configurations where legitimate corporate SMB shares are reachable over a public-routed IP
- Cloud-hosted file share gateways (e.g., Azure File Sync endpoints) that present as public IPs to on-prem clients
- Security awareness/phishing-simulation platforms intentionally testing forced-auth-style attachments against consenting employees
- Backup or sync agents launched via Explorer-adjacent shell integration that legitimately reach an external SMB-over-internet service
Sigma rule & cross-platform mapping
The detection logic for Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes (THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Outbound SMB Connection Attempt to External IP from Browser Process
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents showing powershell.exe (or its child network stack) initiating a connection to 203.0.113.10 on port 445 from the test host.
- Test 2Explorer UNC Path Navigation to External Host
Expected signal: Sysmon Event ID 3 showing explorer.exe initiating an outbound connection to 203.0.113.10 on port 445; likely followed by a failed/timeout connection since no real share exists at the test IP.
- Test 3Simulated Attachment Delivery Followed by Outbound SMB Within Correlation Window
Expected signal: A synthetic JSON record simulating an EmailAttachmentInfo entry (FileType=zip) for [email protected], plus a genuine Sysmon Event ID 3 outbound connection to 203.0.113.10:445 within the same minute.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month