{"id":"T1187","name":"Forced Authentication","url":"https://attack.mitre.org/techniques/T1187","tactics":["credential-access"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0022","stix_id":"x-mitre-detection-strategy--b45310bb-d520-43b3-8758-e9d5a9738429","name":"Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM","url":"https://attack.mitre.org/detectionstrategies/DET0022","analytics":[{"id":"AN0065","stix_id":"x-mitre-analytic--f2064dd1-8cdb-472e-b187-8d1ef18fb059","name":"Analytic 0065","description":"Adversary stages a lure that references a remote resource (e.g., LNK/SCF/Office template). When the user opens/renders the file or a shell enumerates icons, the host automatically attempts SMB or WebDAV authentication to the attacker host. The chain is: (1) lure file is created or modified in a user-exposed location → (2) user or system accesses the lure → (3) host makes outbound NTLM (SMB 139/445 or WebDAV over 80/443) to an untrusted destination → (4) repeated attempts from multiple users/hosts or from privileged workstations.","url":"https://attack.mitre.org/detectionstrategies/DET0022#AN0065","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-security"},{"name":"NSM:Flow","channel":"HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"NSM:Flow","channel":"Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"UserLocations","description":"Folders where lures are most effective (Desktop, Public, Downloads, Temp, Cache, Start Menu, Startup). Adjust to enterprise layout."},{"field":"LureExtensions","description":"File types commonly abused (.lnk, .scf, .url, .doc/.xls/.ppt/.pdf/.html). Extend for your tooling and languages."},{"field":"UntrustedCIDR/DNS","description":"Org-specific list of external/unknown networks or domains; used to suppress sanctioned file servers and WebDAV gateways."},{"field":"TimeWindow","description":"Correlation horizon (e.g., 15–30 minutes) between file access and outbound NTLM attempt."},{"field":"WorkstationZones","description":"Asset/zone tags that distinguish workstations from servers; helps flag workstation→workstation SMB, which is often abnormal."},{"field":"OfficeTemplatePaths","description":"Paths to Office templates to catch template injection references and abnormal loads."}],"live":true,"detection_strategies":["DET0022"],"techniques":["T1187"]}],"live":true,"version":"1.0","techniques":["T1187"]}],"sigma_rules":[{"id":"0ed99dda-6a35-11ef-8c99-0242ac120002","title":"Attempts of Kerberos Coercion Via DNS SPN Spoofing","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-20","modified":null,"description":"Detects the presence of \"UWhRC....AAYBAAAA\" pattern in command line.\nThe pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\nAttackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\nIt is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\nto spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073.\nIf you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records,\nor checking for the presence of such records through the `nslookup` command.\n","references":["https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025","https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.credential-access","attack.persistence","attack.privilege-escalation","attack.t1557.001","attack.t1187"],"path":"rules/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml","techniques":["T1557.001","T1187"],"cves":[]},{"id":"1ce8c8a3-2723-48ed-8246-906ac91061a6","title":"Possible PetitPotam Coerce Authentication Attempt","author":"Mauricio Velazco, Michael Haag","status":"test","level":"high","date":"2021-09-02","modified":"2022-08-11","description":"Detect PetitPotam coerced authentication activity.","references":["https://github.com/topotam/PetitPotam","https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1187"],"path":"rules/windows/builtin/security/win_security_petitpotam_network_share.yml","techniques":["T1187"],"cves":[]},{"id":"4096842a-8f9f-4d36-92b4-d0b2a62f9b2a","title":"Potential PetitPotam Attack Via EFS RPC Calls","author":"@neu5ron, @Antonlovesdnb, Mike Remen","status":"test","level":"medium","date":"2021-08-17","modified":"2022-11-28","description":"Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.\nThe usage of this RPC function should be rare if ever used at all.\nThus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.\n View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'\n","references":["https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp","https://msrc.microsoft.com/update-guide/vulnerability/ADV210003","https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf","https://threatpost.com/microsoft-petitpotam-poc/168163/"],"logsource":{"product":"zeek","service":"dce_rpc"},"tags":["attack.collection","attack.credential-access","attack.t1557.001","attack.t1187"],"path":"rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml","techniques":["T1557.001","T1187"],"cves":[]},{"id":"5588576c-5898-4fac-bcdd-7475a60e8f43","title":"Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-20","modified":null,"description":"Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.\nThe pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\nAttackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\nIt is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\nto spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.\n","references":["https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025","https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html"],"logsource":{"product":"zeek","service":"dns"},"tags":["attack.collection","attack.credential-access","attack.persistence","attack.privilege-escalation","attack.t1557.001","attack.t1187"],"path":"rules/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml","techniques":["T1557.001","T1187"],"cves":[]},{"id":"5a7132c0-86db-4e6b-95c0-f0e9d7f461aa","title":"Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit","author":"Gene Kazimiarovich","status":"experimental","level":"medium","date":"2025-04-20","modified":null,"description":"Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction.\nIf the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.\n","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054","https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/"],"logsource":{"product":"windows","category":"file_event"},"tags":["detection.emerging-threats","attack.credential-access","attack.t1187","cve.2025-24054"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml","techniques":["T1187"],"cves":["CVE-2025-24054"]},{"id":"6a53d871-682d-40b6-83e0-b7c1a6c4e3a5","title":"PetitPotam Suspicious Kerberos TGT Request","author":"Mauricio Velazco, Michael Haag","status":"test","level":"high","date":"2021-09-02","modified":"2022-10-05","description":"Detect suspicious Kerberos TGT requests.\nOnce an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.\nOne way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.\nThis request will generate a 4768 event with some unusual fields depending on the environment.\nThis analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.\n","references":["https://github.com/topotam/PetitPotam","https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/","https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1187"],"path":"rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml","techniques":["T1187"],"cves":[]},{"id":"7c3a5b1d-9e2f-4a8c-b5d7-1e0f3c6a9b2d","title":"Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI","author":"Samir Bousseaden, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2026-04-28","modified":null,"description":"Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:).\nAn attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource.\nWhen a UNC path is used (e.g. \\\\attacker.com\\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash.\nHTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access.\nThe URI can be delivered via a malicious hyperlink, phishing email, or web page.\n","references":["https://x.com/BlackArrowSec/status/2044374743491424508","https://x.com/SBousseaden/status/2044417029721997635"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1187","detection.emerging-threats","cve.2026-33829"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-33829/proc_creation_win_exploit_cve_2026_33829.yml","techniques":["T1187"],"cves":["CVE-2026-33829"]},{"id":"916eb839-895e-47f8-99ee-3008bf377a3e","title":"NTLM Hash Leak Via Curl NTLM Authentication","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2026-06-04","modified":null,"description":"Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an\nattacker-controlled server, enabling offline cracking or relay attacks.\nWhen no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials\nstored in LSASS — without requiring a plaintext password.\nThis behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.\n","references":["https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140","https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm","https://curl.se/docs/manpage.html#--ntlm"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1187"],"path":"rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml","techniques":["T1187"],"cves":[]},{"id":"e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c","title":"Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-20","modified":null,"description":"Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.\nThe pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\nAttackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\nIt is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\nto spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.\n","references":["https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025","https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.collection","attack.credential-access","attack.persistence","attack.privilege-escalation","attack.t1557.001","attack.t1187"],"path":"rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml","techniques":["T1557.001","T1187"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}