Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit

Status: experimental
Severity: medium
Log source: category file_event, product windows
Author: Gene Kazimiarovich
Source: github.com/SigmaHQ/sigma

Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction. If the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.

Known false positives

Legitimate Library shortcuts under %APPDATA%\Microsoft\Windows\Libraries\ (rarely created by end-users)
Custom corporate scripts that programmatically generate .library-ms Files

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1187` Forced Authentication

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit
id: 5a7132c0-86db-4e6b-95c0-f0e9d7f461aa
status: experimental
description: |
    Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction.
    If the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
    - https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
author: Gene Kazimiarovich
date: 2025-04-20
tags:
    - detection.emerging-threats
    - attack.credential-access
    - attack.t1187   # Forced Authentication
    - cve.2025-24054
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '.library-ms'
        Image|endswith:
            - '\7z.exe'
            - '\winrar.exe'
            - '\explorer.exe'
    condition: selection
falsepositives:
    - Legitimate Library shortcuts under %APPDATA%\Microsoft\Windows\Libraries\ (rarely created by end-users)
    - Custom corporate scripts that programmatically generate .library-ms Files
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename|endswith: '.library-ms'
    Image|endswith:
        - '\7z.exe'
        - '\winrar.exe'
        - '\explorer.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\7z.exe` corpus 4 (sigma 4) `\explorer.exe` corpus 13 (sigma 13) `\winrar.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with`
`TargetFilename`	ends_with	`.library-ms`	`field:"TargetFilename" kind:ends_with value:".library-ms"`