Silent Remote Binary Download via SMB (CVE-2025-50154)

Aaron Mog@AaronMogS2S

•updated Aug 13, 2025•3•1•69

Detects when the explorer.exe process makes a network connection over SMB to a remote host and subsequently creates an executable file. This behavior is indicative of CVE-2025-50154, where a specially crafted LNK file can cause explorer.exe to silently download a binary from a remote share without user interaction.