Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest.
Upgrade to ProDetect Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes in Google Chronicle
Rather than delivering an executable payload, actors such as TA577 email a ZIP attachment containing an HTML file (or, in earlier waves, a direct .url/.search-ms file) whose sole purpose is to reference a remote UNC path (e.g. \\attacker-server\share\file). When the victim opens the attachment, Windows automatically attempts SMB authentication to the attacker-controlled server to resolve the path — leaking the user's NetNTLMv2 challenge-response hash over the wire without ever executing malicious code on the endpoint. The captured hash is then cracked offline or relayed (NTLM relay) to gain credentials or a foothold. Because no payload runs and no persistence is established, this is reconnaissance/information-gathering via a phishing lure (T1598.002 — Phishing for Information: Spearphishing Attachment) rather than a delivery mechanism for malware; the objective is purely to elicit authentication material from the target. Detection focuses on the anomaly that outbound SMB (ports 445/139) is almost never legitimate when it originates from a user-facing application (browser, archive utility, Office app, or Explorer) and targets a public, non-RFC1918 IP address, especially when that connection follows shortly after a ZIP/HTML/ISO attachment was delivered to the same mailbox.
MITRE ATT&CK
- Tactic
- Reconnaissance
YARA-L Detection Query
rule attachment_forced_smb_auth_ntlm_harvest {
meta:
author = "Detection Engineering"
description = "Detects outbound SMB connections to public IPs from user-facing processes, indicative of an attachment forcing NTLM hash harvesting"
severity = "HIGH"
confidence = "medium"
mitre_attack = "T1598.002"
reference = "https://attack.mitre.org/techniques/T1598/002/"
events:
$e.metadata.event_type = "NETWORK_CONNECTION"
$e.target.port = 445 or $e.target.port = 139
not net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8")
not net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12")
not net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16")
not net.ip_in_range_cidr($e.target.ip, "169.254.0.0/16")
not net.ip_in_range_cidr($e.target.ip, "127.0.0.0/8")
condition:
$e
}Google Chronicle YARA-L 2.0 detection for outbound SMB (445/139) network connections to public, non-RFC1918 IP addresses — the network-layer signature of an attachment-triggered forced-authentication attempt used to harvest NTLM hashes.
Data Sources
Required Tables
False Positives & Tuning
- VPN/SD-WAN configurations exposing internal SMB shares over a public IP
- Cloud-hosted file-share gateways
- Authorized phishing-simulation platform testing
Other platforms for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Outbound SMB Connection Attempt to External IP from Browser Process
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents showing powershell.exe (or its child network stack) initiating a connection to 203.0.113.10 on port 445 from the test host.
- Test 2Explorer UNC Path Navigation to External Host
Expected signal: Sysmon Event ID 3 showing explorer.exe initiating an outbound connection to 203.0.113.10 on port 445; likely followed by a failed/timeout connection since no real share exists at the test IP.
- Test 3Simulated Attachment Delivery Followed by Outbound SMB Within Correlation Window
Expected signal: A synthetic JSON record simulating an EmailAttachmentInfo entry (FileType=zip) for [email protected], plus a genuine Sysmon Event ID 3 outbound connection to 203.0.113.10:445 within the same minute.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month