PowerShell toolkit to audit, harden, and hunt for insecure NTLM/SMB usage, addressing CVE-2025-50154 credential leak risks with event log analysis and detection queries.
Author: w01f
Version: 1.0
Purpose: Audit, harden, and hunt for insecure NTLM/SMB usage to mitigate risks such as CVE-2025-50154.
Severity: High
Type: NTLM Credential Leak + Patch Bypass (Zero-Click)
Affected: Windows 10/11, Windows Server
Summary:
CVE-2025-50154 is a bypass of Microsoft's earlier patch for CVE-2025-24054. Even with the previous mitigation, a crafted file or UNC path can trigger Windows Explorer to fetch a remote resource and initiate NTLM authentication without any user interaction (zero-click).
This can lead to:
Why it matters: This bypass shows that attackers can still exploit legacy authentication paths through Explorer’s resource handling. Hardening NTLM and SMB client behavior, plus monitoring for suspicious Explorer-initiated connections, is critical.
.\NTLM_SMB_HardeningToolkit.ps1 -Mode Audit -AllowlistCIDRs "10.0.0.0/8,192.168.0.0/16" -HoursBack 24 -ExportJson .\ntlm_audit.json
.\NTLM_SMB_HardeningToolkit.ps1 -Mode Harden -AllowlistCIDRs "10.0.0.0/8,192.168.0.0/16" -SampleHosts "filesrv01.corp,10.0.5.20"
.\NTLM_SMB_HardeningToolkit.ps1 -Mode Revert
Below are drop-in detection queries to identify suspicious NTLM/SMB usage potentially related to CVE-2025-50154 exploitation patterns.
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "explorer.exe"
| where RemotePort in (445, 139)
| where not(RemoteIP in ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"))
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
let lnk = DeviceFileEvents
| where FileName endswith ".lnk"
| where FolderPath has @"\Users\" and FolderPath has @"\Desktop";
let smb = DeviceNetworkEvents
| where RemotePort in (445,139)
| where InitiatingProcessFileName =~ "explorer.exe";
lnk
| join kind=innerunique (smb) on DeviceId
| where smb.Timestamp between (lnk.Timestamp .. lnk.Timestamp + 5m)
| project DeviceName, lnk.Timestamp, smb.Timestamp, FolderPath, RemoteIP
DeviceLogonEvents
| where LogonType == "Network"
| where AuthenticationPackage =~ "NTLM"
| summarize count() by DeviceName, RemoteIP, AccountUpn, bin(Timestamp, 10m)
| order by count_ desc
explorer.exe to TCP 445/139 outside allowlist..lnk files on user desktops.This toolkit is provided for educational and defensive security purposes only.
Do not use in production environments without change control and testing.