Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest.
Upgrade to ProDetect Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes in Microsoft Sentinel
Rather than delivering an executable payload, actors such as TA577 email a ZIP attachment containing an HTML file (or, in earlier waves, a direct .url/.search-ms file) whose sole purpose is to reference a remote UNC path (e.g. \\attacker-server\share\file). When the victim opens the attachment, Windows automatically attempts SMB authentication to the attacker-controlled server to resolve the path — leaking the user's NetNTLMv2 challenge-response hash over the wire without ever executing malicious code on the endpoint. The captured hash is then cracked offline or relayed (NTLM relay) to gain credentials or a foothold. Because no payload runs and no persistence is established, this is reconnaissance/information-gathering via a phishing lure (T1598.002 — Phishing for Information: Spearphishing Attachment) rather than a delivery mechanism for malware; the objective is purely to elicit authentication material from the target. Detection focuses on the anomaly that outbound SMB (ports 445/139) is almost never legitimate when it originates from a user-facing application (browser, archive utility, Office app, or Explorer) and targets a public, non-RFC1918 IP address, especially when that connection follows shortly after a ZIP/HTML/ISO attachment was delivered to the same mailbox.
MITRE ATT&CK
- Tactic
- Reconnaissance
KQL Detection Query
// THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest (T1598.002) - Attachment forces outbound SMB auth to harvest NTLM hashes
let SuspiciousInitiators = dynamic(["explorer.exe", "iexplore.exe", "msedge.exe", "chrome.exe", "firefox.exe",
"WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "7zFM.exe", "WinRAR.exe", "Notepad.exe"]);
// Pillar 1: outbound SMB (445/139) from a user-facing app to a public (non-RFC1918) IP
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (445, 139)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName in~ (SuspiciousInitiators)
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")
or ipv4_is_in_range(RemoteIP, "172.16.0.0/12")
or ipv4_is_in_range(RemoteIP, "192.168.0.0/16")
or ipv4_is_in_range(RemoteIP, "169.254.0.0/16")
or ipv4_is_in_range(RemoteIP, "127.0.0.0/8"))
| extend SuspicionReason = "OutboundSMBToPublicIPFromUserApp"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, InitiatingProcessFileName,
RemoteIP, RemotePort, SuspicionReason
| union (
// Pillar 2: ZIP/HTML/ISO attachment delivered, followed by outbound SMB from the same recipient within 60 minutes
let RiskyAttachments = EmailAttachmentInfo
| where Timestamp > ago(24h)
| where FileType in~ ("zip", "html", "htm", "iso", "img")
| project DeliveryTime=Timestamp, RecipientEmailAddress, FileName, SenderFromAddress;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (445, 139)
| where ActionType == "ConnectionSuccess"
| extend RecipientEmailAddress = InitiatingProcessAccountUpn
| join kind=inner RiskyAttachments on RecipientEmailAddress
| where datetime_diff('minute', Timestamp, DeliveryTime) between (0 .. 60)
| extend SuspicionReason = "AttachmentDeliveryFollowedByOutboundSMB"
| project Timestamp, DeviceName, AccountName=RecipientEmailAddress, InitiatingProcessFileName,
RemoteIP, RemotePort, SuspicionReason
)
| sort by Timestamp descTwo-pillar detection for attachment-driven forced SMB authentication used to harvest NTLM hashes. Pillar 1 flags any outbound SMB (445/139) connection made by a user-facing process (browser, Office app, archive utility, Explorer) to a public IP — legitimate SMB traffic is virtually always intra-network, so this alone is a strong anomaly. Pillar 2 narrows to cases where a ZIP/HTML/ISO attachment was delivered to the same mailbox within the prior 60 minutes, tightening the correlation to the specific attachment-triggered forced-auth pattern documented in TA577 campaigns.
Data Sources
Required Tables
False Positives & Tuning
- VPN or SD-WAN split-tunnel configurations where legitimate corporate SMB shares are reachable over a public-routed IP
- Cloud-hosted file share gateways (e.g., Azure File Sync endpoints) that present as public IPs to on-prem clients
- Security awareness/phishing-simulation platforms intentionally testing forced-auth-style attachments against consenting employees
- Backup or sync agents launched via Explorer-adjacent shell integration that legitimately reach an external SMB-over-internet service
Other platforms for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Outbound SMB Connection Attempt to External IP from Browser Process
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents showing powershell.exe (or its child network stack) initiating a connection to 203.0.113.10 on port 445 from the test host.
- Test 2Explorer UNC Path Navigation to External Host
Expected signal: Sysmon Event ID 3 showing explorer.exe initiating an outbound connection to 203.0.113.10 on port 445; likely followed by a failed/timeout connection since no real share exists at the test IP.
- Test 3Simulated Attachment Delivery Followed by Outbound SMB Within Correlation Window
Expected signal: A synthetic JSON record simulating an EmailAttachmentInfo entry (FileType=zip) for [email protected], plus a genuine Sysmon Event ID 3 outbound connection to 203.0.113.10:445 within the same minute.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month