Suspicious Creation of .library-ms File - Potential CVE-2025-24054 Exploit

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•0•41

Detects the creation of '.library-ms' files by common archive extraction tools or Windows Explorer, which may indicate an attempt to exploit CVE-2025-24054. This vulnerability can lead to automatic outbound SMB or WebDAV authentication requests, potentially exposing NTLMv2-SSP hashes to an attacker without user interaction beyond archive extraction on unpatched systems.