Sigma rule: Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit

Rule

Title

Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit

Status

experimental

Level

medium

Author

Gene Kazimiarovich

Date

2025-04-20

File

rules-emerging-threats/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction.
If the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith: '.library-ms'
    Image|endswith:
        - '\7z.exe'
        - '\winrar.exe'
        - '\explorer.exe'
condition: selection

False positives (as the rule lists them)

• Legitimate Library shortcuts under %APPDATA%\Microsoft\Windows\Libraries\ (rarely created by end-users)
• Custom corporate scripts that programmatically generate .library-ms Files

Tags

• detection.emerging-threats
• attack.credential-access
• attack.t1187
• cve.2025-24054

CVEs this rule names

• CVE-2025-24054

MITRE ATT&CK ids this rule names

• T1187

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
• https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml