Suspicious Url File Execution And SMB Network Connection

Tim Peck@timpeck

•updated Nov 26, 2025•6•1•174

Detects a network connection to an external SMB or WebDAV server immediately following the launch of a .url file. This behavior is associated with CVE-2024-43451, where threat actors use malicious .url files to leak NTLM hashes.