Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest.
Upgrade to ProDetect Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes in Splunk
Rather than delivering an executable payload, actors such as TA577 email a ZIP attachment containing an HTML file (or, in earlier waves, a direct .url/.search-ms file) whose sole purpose is to reference a remote UNC path (e.g. \\attacker-server\share\file). When the victim opens the attachment, Windows automatically attempts SMB authentication to the attacker-controlled server to resolve the path — leaking the user's NetNTLMv2 challenge-response hash over the wire without ever executing malicious code on the endpoint. The captured hash is then cracked offline or relayed (NTLM relay) to gain credentials or a foothold. Because no payload runs and no persistence is established, this is reconnaissance/information-gathering via a phishing lure (T1598.002 — Phishing for Information: Spearphishing Attachment) rather than a delivery mechanism for malware; the objective is purely to elicit authentication material from the target. Detection focuses on the anomaly that outbound SMB (ports 445/139) is almost never legitimate when it originates from a user-facing application (browser, archive utility, Office app, or Explorer) and targets a public, non-RFC1918 IP address, especially when that connection follows shortly after a ZIP/HTML/ISO attachment was delivered to the same mailbox.
MITRE ATT&CK
- Tactic
- Reconnaissance
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
DestinationPort IN (445, 139)
Image IN ("*\\explorer.exe", "*\\iexplore.exe", "*\\msedge.exe", "*\\chrome.exe", "*\\firefox.exe",
"*\\WINWORD.EXE", "*\\EXCEL.EXE", "*\\POWERPNT.EXE", "*\\7zFM.exe", "*\\WinRAR.exe")
NOT (
cidrmatch("10.0.0.0/8", DestinationIp)
OR cidrmatch("172.16.0.0/12", DestinationIp)
OR cidrmatch("192.168.0.0/16", DestinationIp)
OR cidrmatch("169.254.0.0/16", DestinationIp)
OR cidrmatch("127.0.0.0/8", DestinationIp)
)
| eval SuspicionReason="OutboundSMBToPublicIPFromUserApp"
| stats count as ConnCount, values(DestinationIp) as RemoteIPs, min(_time) as FirstSeen by host, User, Image, SuspicionReason
| sort - FirstSeenSysmon Event ID 3 (network connection) detection for outbound SMB (445/139) initiated by a user-facing process to a public, non-RFC1918 destination — the core anomaly generated when an opened attachment forces the OS to authenticate to an attacker-controlled SMB server. Requires Sysmon network-connection logging enabled and CIDR-aware filtering (cidrmatch) rather than plain string matching to correctly exclude internal ranges.
Data Sources
Required Sourcetypes
False Positives & Tuning
- VPN/SD-WAN split-tunnel setups where an internal SMB share resolves via a public-routed IP
- Cloud file-share gateways presenting as public IPs to on-prem clients
- Authorized phishing-simulation platforms testing forced-auth attachment lures
- Legitimate third-party backup/sync agents reaching an external SMB-over-internet service
Other platforms for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Outbound SMB Connection Attempt to External IP from Browser Process
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents showing powershell.exe (or its child network stack) initiating a connection to 203.0.113.10 on port 445 from the test host.
- Test 2Explorer UNC Path Navigation to External Host
Expected signal: Sysmon Event ID 3 showing explorer.exe initiating an outbound connection to 203.0.113.10 on port 445; likely followed by a failed/timeout connection since no real share exists at the test IP.
- Test 3Simulated Attachment Delivery Followed by Outbound SMB Within Correlation Window
Expected signal: A synthetic JSON record simulating an EmailAttachmentInfo entry (FileType=zip) for [email protected], plus a genuine Sysmon Event ID 3 outbound connection to 203.0.113.10:445 within the same minute.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month