Phoenix
Sigma IntelligenceBeta
Emerging Threats
CVE2025

CVE-2025-24054

1Rules
2References
1Folders
2025-04-20Latest
Summary

CVE-2025-24054 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on windows / file_event.

Related Detections
Search this threat
Emerging Threatmediumexperimental

Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit

Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction. If the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.

WindowsFile Event
detection.emerging-threatsTA0006 · Credential AccessT1187 · Forced Authenticationcve.2025-24054
Gene KazimiarovichSun Apr 202025
References
1
Resolving title…
msrc.microsoft.com
2
Resolving title…
research.checkpoint.com