Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest.
Upgrade to ProDetect Email Attachment Forces Outbound SMB Authentication to Harvest NTLM Hashes in Sumo Logic CSE
Rather than delivering an executable payload, actors such as TA577 email a ZIP attachment containing an HTML file (or, in earlier waves, a direct .url/.search-ms file) whose sole purpose is to reference a remote UNC path (e.g. \\attacker-server\share\file). When the victim opens the attachment, Windows automatically attempts SMB authentication to the attacker-controlled server to resolve the path — leaking the user's NetNTLMv2 challenge-response hash over the wire without ever executing malicious code on the endpoint. The captured hash is then cracked offline or relayed (NTLM relay) to gain credentials or a foothold. Because no payload runs and no persistence is established, this is reconnaissance/information-gathering via a phishing lure (T1598.002 — Phishing for Information: Spearphishing Attachment) rather than a delivery mechanism for malware; the objective is purely to elicit authentication material from the target. Detection focuses on the anomaly that outbound SMB (ports 445/139) is almost never legitimate when it originates from a user-facing application (browser, archive utility, Office app, or Explorer) and targets a public, non-RFC1918 IP address, especially when that connection follows shortly after a ZIP/HTML/ISO attachment was delivered to the same mailbox.
MITRE ATT&CK
- Tactic
- Reconnaissance
Sumo Detection Query
_sourceCategory=*sysmon*
| json auto
| where DestinationPort matches "445" or DestinationPort matches "139"
| where !cidr(DestinationIp, "10.0.0.0/8") and !cidr(DestinationIp, "172.16.0.0/12") and !cidr(DestinationIp, "192.168.0.0/16") and !cidr(DestinationIp, "169.254.0.0/16") and !cidr(DestinationIp, "127.0.0.0/8")
| eval RiskScore = 80
| stats count as ConnCount, values(DestinationIp) as RemoteIPs by _sourceHost, Image, RiskScore
| sort by RiskScore descSumo Logic detection for outbound SMB (445/139) connections from endpoint processes to public IP addresses, excluding RFC1918/loopback ranges via the cidr operator, flagging the network anomaly produced by attachment-driven forced SMB authentication.
Data Sources
Required Tables
False Positives & Tuning
- VPN/SD-WAN split-tunnel configurations exposing internal SMB shares over a public IP
- Cloud-hosted file-share gateways
- Authorized phishing-simulation testing
Other platforms for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Outbound SMB Connection Attempt to External IP from Browser Process
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents showing powershell.exe (or its child network stack) initiating a connection to 203.0.113.10 on port 445 from the test host.
- Test 2Explorer UNC Path Navigation to External Host
Expected signal: Sysmon Event ID 3 showing explorer.exe initiating an outbound connection to 203.0.113.10 on port 445; likely followed by a failed/timeout connection since no real share exists at the test IP.
- Test 3Simulated Attachment Delivery Followed by Outbound SMB Within Correlation Window
Expected signal: A synthetic JSON record simulating an EmailAttachmentInfo entry (FileType=zip) for [email protected], plus a genuine Sysmon Event ID 3 outbound connection to 203.0.113.10:445 within the same minute.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-AttachmentForcedSMBAuthNTLMHarvest — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month