Potential NTLM hash leak via shortcut file
Identifies potential NTLM hash leakage via malicious shortcut (.lnk) file processing. By crafting a .lnk file with a default icon from shell32.dll and the target path pointing to a remote SMB-hosted binary file, the explorer.exe process will fetch the remote file to extract the icon from the PE resource directory, leading to NTLM hash leak.
- Platform: Windows
- Severity: High
- MITRE Tactic: Credential Access
- MITRE Techniques: T1187