CVE-2024-43451

What it actually does

This vulnerability causes Windows to disclose a user's NTLMv2 authentication material to an attacker-controlled location through spoofed content or file handling behavior. With minimal user interaction, such as selecting, previewing, inspecting, or otherwise causing Windows Explorer or a related component to process a malicious object, the system may initiate NTLM authentication to a remote server controlled by the attacker. The attacker can capture the NetNTLMv2 challenge-response and attempt offline password cracking or relay it to services that accept NTLM, potentially enabling unauthorized access without knowing the user's plaintext password.

Why it matters to the business

Successful exploitation can expose employee authentication material and create a path to account compromise, lateral movement, and unauthorized access to internal systems. Because this issue is listed in CISA KEV, has documented active exploitation, and has a high EPSS score, organizations should treat it as an urgent credential-exposure risk even though it does not directly execute code. Operational impact may include forced password resets, incident response activity, NTLM hardening work, and accelerated Windows patching. CISA's KEV remediation deadline was 2024-12-03, so unpatched systems remain materially overdue for remediation.

How an attack unfolds

An attacker prepares a malicious file, shortcut, document container, or other content that triggers Windows to resolve or access an attacker-controlled network resource. The attacker delivers the content by email, web download, file share, messaging platform, or another social-engineering channel. When a user interacts with the object, Windows may automatically attempt NTLM authentication to the remote destination. The attacker captures the user's NetNTLMv2 challenge-response. From there, the attacker can attempt to crack the response offline to recover the password or relay the authentication to another NTLM-enabled service if protections such as SMB signing, EPA, and NTLM restrictions are not enforced. Reported exploitation activity is consistent with broader NTLM hash leakage and relay campaigns rather than ransomware-specific use.

How to fix it

Apply the relevant Microsoft security updates that address CVE-2024-43451 across supported Windows systems. Because no product-specific fixed versions were provided in the input, use the latest cumulative updates from Microsoft for the affected Windows versions and confirm the November 2024 or later security update level is installed. In parallel, reduce NTLM exposure: disable or restrict outbound NTLM where feasible, block outbound SMB to the internet at network egress, require SMB signing, enable Extended Protection for Authentication on supported services, reduce WebDAV/WebClient exposure if not required, and audit applications that still depend on NTLM. Enforce strong password policy and consider password resets for accounts suspected of leaking NetNTLMv2 material.

How to confirm the fix worked

Confirm Windows systems have installed the Microsoft security update that includes the fix for this vulnerability, preferably by verifying the installed cumulative update level with enterprise patch management, Windows Update history, or PowerShell inventory. Validate exposure reduction by testing that workstations cannot initiate outbound SMB connections to untrusted internet destinations and that NTLM usage is blocked or audited according to policy. Confirm NTLM hardening by reviewing Group Policy settings for NTLM restrictions, SMB signing, and WebClient/WebDAV service usage. Where compensating controls are used, perform a controlled test with a benign NTLM-capture server to verify that selecting or previewing external content does not leak NTLM credentials outside approved boundaries.

Typical attack path

1. Identify users or organizations where Windows clients may process externally supplied files or links.
2. Craft spoofed content that causes Windows to initiate NTLM authentication to an attacker-controlled SMB, WebDAV, HTTP, or related endpoint.
3. Deliver the malicious object through phishing, a hosted download, collaboration platform, archive, or shared location.
4. Wait for a user to select, preview, inspect, or otherwise interact with the object.
5. Capture the NetNTLMv2 challenge-response from the inbound authentication attempt.
6. Attempt offline password cracking or relay the captured authentication to an NTLM-enabled service.
7. Use any successful authentication to access resources, escalate privileges, or move laterally.

How to detect it

Look for evidence that Windows clients attempted NTLM authentication to unusual or external destinations shortly after users interacted with downloaded files, email attachments, archives, shortcuts, or web content. Useful sources include Windows Security logs, Microsoft-Windows-NTLM/Operational logs, Microsoft-Windows-SMBClient logs, Sysmon network connection events, endpoint telemetry for Explorer or Office-initiated network connections, proxy logs, DNS logs, firewall egress logs, and email/web gateway records. Focus on outbound SMB, WebDAV, or HTTP-based NTLM authentication to public IP addresses, newly registered domains, URL shorteners, or infrastructure not normally used for authentication. Investigate Security Event ID 4624 logon type 3 using NTLM, domain controller Event ID 4776 validation events, NTLM Operational Event IDs that show outgoing NTLM usage, and Sysmon Event ID 3 connections from explorer.exe, Microsoft Office processes, archive handlers, or preview handlers to untrusted hosts. If suspicious authentication is found, preserve the original delivered files, identify all users who accessed them, determine whether the captured NetNTLMv2 response may have been relayed or cracked, and review subsequent successful logons from unusual sources.

• Microsoft-Windows-NTLM/Operational
• Microsoft-Windows-SMBClient/Connectivity
• Microsoft-Windows-SMBClient/Security
• Event ID 4624
• Event ID 4776
• Logon Type: 3
• Authentication Package: NTLM
• Package Name (NTLM only): NTLM V2
• LmPackageName: NTLM V2
• C:\Windows\explorer.exe
• \Windows\System32\WebClnt.dll
• WebClient
• DestinationPort=445
• DestinationPort=139
• DestinationPort=80
• DestinationPort=443
• Image: C:\Windows\explorer.exe
• Image: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
• Image: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
• Image: C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
• Image: C:\Windows\System32\rundll32.exe
• EventCode=3 DestinationPort=445
• EventCode=3 DestinationPort=139
• EventCode=3 DestinationPort=80
• EventCode=3 DestinationPort=443
• \\@
• file://
• search-ms:
• WebDAV

What your security team should do

• Prioritize patching because the vulnerability is in CISA KEV, is actively exploited in the wild, and has a high EPSS score.
• Verify all supported Windows endpoints and servers have the relevant November 2024 or later cumulative security update installed.
• Block outbound SMB traffic, especially TCP 445 and 139, from workstations to the internet and untrusted networks.
• Audit and restrict NTLM authentication using Microsoft-Windows-NTLM operational logs and Group Policy controls.
• Require SMB signing and enable Extended Protection for Authentication on services that still accept NTLM.
• Review recent outbound SMB, WebDAV, and NTLM authentication events for signs of credential leakage to unfamiliar hosts.
• If exploitation is suspected, reset passwords for affected users and invalidate exposed credentials after containment.
• Hunt for phishing messages, downloaded archives, shortcut files, or documents that caused external authentication attempts.
• Reduce reliance on NTLM over time by migrating services to Kerberos or modern authentication where possible.