Coverage › CVE-2025-24991
CVE-2025-24991 Mapped Sigma
Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability
- Vendor / product
- Microsoft — Windows
- Description (CISA)
- Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.
- Added to KEV
- 2025-03-11
- Due date
- 2025-04-01
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-125
- CISA notes
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24991
https://nvd.nist.gov/vuln/detail/CVE-2025-24991 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1091 Replication Through Removable Media | exploitation technique | This vulnerability is facilitated by the insertion of information into log files, which could lead to the disclosure of said sensitive information through an attack. In order to exploit this vulnerability, an attacker needs physical access to the system, such as the ability to mount an external drive. ref 1 |
live |
| T1005 Data from Local System | primary impact | This vulnerability is facilitated by the insertion of information into log files, which could lead to the disclosure of said sensitive information through an attack. In order to exploit this vulnerability, an attacker needs physical access to the system, such as the ability to mount an external drive. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1005 Data from Local System primary impact
- DET0380 Detection of Local Data Collection Prior to Exfiltration
AN1070 WindowsAdversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.Tunable:
TargetFilePathRegexParentProcessFilterAN1071 LinuxAdversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.Tunable:TimeWindowScriptToolNameAN1072 macOSAdversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.Tunable:UserContextTargetVolumeAN1073 Network DevicesCollection of device configuration via CLI commands (e.g.,show running-config,copy flash,more), often followed by TFTP/SCP transfers.Tunable:CommandScopeAuthenticatedUserListAN1074 ESXiAdversaries accessing datastore or configuration files viavim-cmd,esxcli, or SCP to extract logs, VMs, or host configurations.Tunable:AccessPathRegexInteractiveShellUsage
Sigma rules tagged attack.t1005 (14)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Roberto Rodriguez @Cyb3rWard0g
· 2021-10-08 (modified 2023-11-30) · logsource: product=windows category=pipe_created · 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Author: TropChaud
· 2022-12-19 (modified 2023-01-19) · logsource: product=windows category=process_creation · 24c77512-782b-448a-8950-eddb0785fc71
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Author: frack113
· 2021-08-16 (modified 2023-05-04) · logsource: product=windows category=process_creation · 2f47f1fd-0901-466e-a770-3b7092834a1b
Detects a command used by conti to dump database
Author: frack113
· 2022-04-08 (modified 2023-01-19) · logsource: product=windows category=process_creation · 4833155a-4053-4c9c-a997-777fcea0baa7
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Author: Diogo Braz
· 2020-04-16 (modified 2022-10-05) · logsource: product=aws service=cloudtrail · 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-04 · logsource: product=windows category=process_creation · 696bfb54-227e-4602-ac5b-30d9d2053312
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Author: frack113
· 2022-02-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 6a69f62d-ce75-4b57-8dce-6351eb55b362
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe
Author: Jason Mull
· 2025-05-12 · logsource: product=windows service=system · 882fbe50-d8d7-4e29-ae80-0648a8556866
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Author: frack113
· 2021-12-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · b57ba453-b384-4ab9-9f40-1038086b4e53
Detects dump of credentials in VeeamBackup dbo
Author: Austin Clark
· 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a
Collect pertinent data from the configuration files
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
T1091 Replication Through Removable Media exploitation technique
- DET0301 Removable Media Execution Chain Detection via File and Process Activity
AN0841 WindowsExecution of files originating from removable media after drive mount, with correlation to file write activity, autorun usage, or lateral spread via staged tools.WinEventLog:Microsoft-Windows-Windows Defender/Operational
Suspicious file execution on removable media path→ DC0055 File AccessTunable:DriveLetterMatchFileExecutionWindowParentProcessFileEntropy
Sigma rules tagged attack.t1091 (1)
Author: Keith Wright
· 2019-11-20 (modified 2024-02-09) · logsource: product=windows service=security · f69a87ea-955e-4fb4-adb2-bb9fd6685632
Detects external disk drives or plugged-in USB devices.