Windows applications can sometimes trigger SMB authentication when they access crafted paths or remote resources. If the destination is untrusted, this behavior can expose NTLM authentication material and become a credential-security concern.
The source includes network and DNS hunts focused on this scenario and specifically references CVE-2025-24054.
Network Detection
The first query searches Sysmon network events for destination port 445 and limits the originating process to applications such as Explorer, Outlook, Word, Excel, PowerPoint, SearchProtocolHost, or DLLHost.
data.win.system.eventID:3 and data.win.eventdata.destinationPort:445 and data.win.eventdata.image:(*\explorer.exe or *\outlook.exe or *\winword.exe or *\excel.exe or *\powerpnt.exe or *\searchprotocolhost.exe or *\dllhost.exe)
The source notes that internet-bound TCP/445 should be treated as high priority.
DNS Detection
A second query searches Sysmon DNS events generated by processes commonly involved in the same type of resource access:
data.win.system.eventID:22 and data.win.eventdata.image:(*\explorer.exe or *\outlook.exe or *\winword.exe or *\searchprotocolhost.exe) and data.win.eventdata.queryName:*
The source recorded zero matching results during the previous 30 days.
Why Context Is Critical
SMB is legitimate in many internal Windows environments. A connection from Explorer to an internal file server may be completely expected.
The risk changes when an Office application or Windows shell component attempts to connect over SMB to an external or unfamiliar address.
That is why analysts should enrich destination information with:
internal versus external classification;
hostname and domain reputation;
user identity;
originating document or file;
preceding DNS queries;
authentication logs.
Investigation Workflow
If a suspicious connection appears, review the application activity immediately before it.
For example, determine whether:
a document was opened;
an archive or shortcut was accessed;
a browser download occurred;
a file contained an external UNC path;
a DNS request resolved to an unexpected destination.
The goal is to understand why the Windows application attempted to authenticate over SMB.
Tuning
Internal SMB activity can create significant noise if the query is used without destination context. A practical production rule should therefore prioritize external destinations and known-untrusted network ranges.
Internal file servers and approved infrastructure can be excluded using explicit destination controls.
Detection Value
The source did not record any matches, but the rule remains useful because credential leakage over SMB can be highly actionable when it occurs toward the internet.
Monitoring the combination of application, network protocol, and destination context provides a focused way to identify suspicious NTLM exposure behavior.
