Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
3
1
Categories
3
3
1
1
1
Platforms
4
Products / Services
3
1
MITRE Techniques
4
1
1
1
CVEs
71
71
64
58
49
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects the creation of '.library-ms' files by common archive extraction tools or Windows Explorer, which may indicate an attempt to exploit CVE-2025-24054. This vulnerability can lead to automatic outbound SMB or WebDAV authentication requests, potentially exposing NTLMv2-SSP hashes to an attacker without user interaction beyond archive extraction on unpatched systems.
