Coverage › CVE-2025-24054
CVE-2025-24054 Mapped Sigma
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
- Vendor / product
- Microsoft — Windows
- Description (CISA)
- Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
- Added to KEV
- 2025-04-17
- Due date
- 2025-05-08
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-73
- CISA notes
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
https://nvd.nist.gov/vuln/detail/CVE-2025-24054 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1566 Phishing | exploitation technique | Using a crafted .library-ms file, attackers can exploit this spoofing vulnerability to gain access to NTLM hashes on the system. This was officially patched by Microsoft on March 11, 2025, but has been exploited in the wild as of March 19, 2025. ref 1 |
live |
| T1555 Credentials from Password Stores | primary impact | Using a crafted .library-ms file, attackers can exploit this spoofing vulnerability to gain access to NTLM hashes on the system. This was officially patched by Microsoft on March 11, 2025, but has been exploited in the wild as of March 19, 2025. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1555 Credentials from Password Stores primary impact
- DET0430 Detect Credentials Access from Password Stores
AN1198 WindowsMonitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.Tunable:
TargetProcessesKeywordPatternsAN1199 LinuxDetects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.Tunable:MonitoredFilesSuspiciousCommandsAN1200 macOSMonitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.Tunable:AllowedApplicationsAlertThresholdAN1201 IaaSDetects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.Tunable:UserContextAccessThreshold
Sigma rules tagged attack.t1555 (8)
Author: Florian Roth (Nextron Systems)
· 2021-07-14 (modified 2022-07-14) · logsource: product=windows category=process_creation · 58f4ea09-0fc2-4520-ba18-b85c540b0eaf
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Author: frack113
· 2021-12-20 (modified 2022-12-25) · logsource: product=windows category=ps_script · 603c6630-5225-49c1-8047-26c964553e0e
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Author: Florian Roth (Nextron Systems)
· 2018-12-19 (modified 2023-02-04) · logsource: product=windows category=process_creation · 7679d464-4f74-45e2-9e01-ac66c5eb041a
Detects the execution of SecurityXploded Tools
Author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
· 2024-06-26 · logsource: product=windows category=file_event · 7892ec59-c5bb-496d-8968-e5d210ca3ac4
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: frack113
· 2021-12-20 (modified 2022-12-25) · logsource: product=windows category=ps_script · 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-21 · logsource: product=aws service=cloudtrail · a840e606-7c8c-4684-9bc1-eb6b6155127f
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
T1566 Phishing exploitation technique
- DET0070 Detection Strategy for Phishing across platforms.
AN0188 WindowsUnusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.m365:unified
Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types→ DC0038 Application Log ContentTunable:SuspiciousFileTypesAllowedSendersAN0189 LinuxMonitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.Application:MailInbound messages with anomalous headers, spoofed SPF/DKIM failures→ DC0038 Application Log Contentauditd:SYSCALLexecve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)→ DC0032 Process CreationTunable:MonitoredMailPathsAttachmentHashBaselineAN0190 macOSDetection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.macos:unifiedlogInbound email activity with suspicious domains or mismatched sender information→ DC0038 Application Log Contentmacos:unifiedlogPreview.app, Safari.app, or Mail.app spawning new processes outside normal patterns→ DC0032 Process CreationTunable:SuspiciousDomainsExecutionDelayWindowAN0191 Office SuitePhishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.m365:unifiedFileAccessed: Access of email attachments by Office applications→ DC0038 Application Log ContentTunable:ParentProcessListMacroExecutionThresholdAN0192 Identity ProviderPhishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.azure:signinlogsFailed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges→ DC0067 Logon Session CreationTunable:GeoAnomalyThresholdMFABypassIndicatorsAN0193 SaaSPhishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.saas:collaborationMessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)→ DC0038 Application Log ContentTunable:MonitoredSaaSAppsLinkInspectionPolicy
Sigma rules tagged attack.t1566 (14)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Ahmed Farouk
· 2024-05-10 · logsource: category=proxy · 1ae64f96-72b6-48b3-ad3d-e71dff6c6398
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Author: Sittikorn S, frack113
· 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: jamesc-grafana
· 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead
Detect when System Manager successfully executes commands against an instance.
Author: Micah Babinski
· 2023-08-21 · logsource: product=windows category=file_event · 4c55738d-72d8-490e-a2db-7969654e375f
Detects the creation of WebDAV temporary files with potentially suspicious extensions
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Sittikorn S
· 2021-07-16 (modified 2022-10-09) · logsource: product=windows category=file_event · ad7085ac-92e4-4b76-8ce2-276d2c0e68ef
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: Florian Roth (Nextron Systems)
· 2017-03-13 (modified 2023-05-18) · logsource: category=proxy · b5de2919-b74a-4805-91a7-5049accbaefe
Detects executable downloads from suspicious remote systems
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
· 2022-10-21 (modified 2023-02-10) · logsource: product=windows category=process_creation · c27515df-97a9-4162-8a60-dc0eeb51b775
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Author: Maxim Pavlunin
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Author: Austin Songer @austinsonger
· 2023-05-07 (modified 2026-04-27) · logsource: product=okta service=okta · ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e
Detects when Okta FastPass prevents a known phishing site.
Author: Florian Roth (Nextron Systems)
· 2022-06-07 · logsource: product=windows category=process_creation · fcdf69e5-a3d3-452a-9724-26f2308bf2b1
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Sigma rules tagged with this CVE directly
1 rule carries cve.2025-24054.
Author: Gene Kazimiarovich
· 2025-04-20 · logsource: product=windows category=file_event · 5a7132c0-86db-4e6b-95c0-f0e9d7f461aa
Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction.
If the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.