Outlook NTLM leak: OUTLOOK.EXE outbound SMB to public IP (CVE-2026-124194)

Falcon Eye@FalconEye

•updated yesterday•46•0•62

Detects OUTLOOK.EXE connecting to public IP addresses over SMB (445/139), which Outlook does not normally do. May indicate forced NTLM authentication and NTLMv2 hash leakage via a crafted message file (CVE-2026-124194, exploited in the wild). The exact file extension of the trigger is not confirmed; likely candidates are .msg and possibly other Outlook message formats (.eml, .oft).