Potential NTLM hash leak via shortcut file
Identifies potential NTLM hash leakage via malicious shortcut (.lnk) file processing. By crafting a .lnk file with a default icon from shell32.dll and the target path pointing to a remote SMB-hosted binary file, the explorer.exe process will fetch the remote file to extract the icon from the PE resource directory, leading to NTLM hash leak.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Acceso a credenciales
- Técnicas MITRE: T1187