.library-ms File Execution Triggering Outbound NTLM Authentication (CVE-2025-24054)

Duo Tech@duotech

•updated Jul 21, 2026•3•0•3

Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.