CVE-2024-43451 Zero-Day (NTLM Hash Disclosure Spoofing Vulnerability)…

….kql
SlimKQL · Nov 15, 2024 · a162b5d · a162b5d
1 parent c25e81d
commit a162b5d
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/DefenderXDR/CVE-2024-43451 Zero-Day (NTLM Hash Disclosure Spoofing Vulnerability).kql b/DefenderXDR/CVE-2024-43451 Zero-Day (NTLM Hash Disclosure Spoofing Vulnerability).kql
@@ -23,4 +23,17 @@ DeviceNetworkEvents
 | where ActionType == "ConnectionSuccess"
 | where DeviceName has_any (VulnerableEndpoint)
 
+// Revised Version v2
+
+let DeviceLNKCreation =
+DeviceFileEvents
+| where ActionType == @"FileCreated"
+| where FileName endswith ".lnk"
+| distinct DeviceName;
+DeviceNetworkEvents
+// NTLM authentication over SMB connection
+| where RemotePort == "445" and RemoteIPType == "Public"
+| where ActionType == "ConnectionSuccess"
+| where DeviceName has_any (DeviceLNKCreation)
+
 // T1550.002: Use Alternate Authentication Material: Pass the Hash