A Windows workstation will send the signed-in user's NTLM response to any SMB or WebDAV path it is asked to open, and a file, shortcut or email that points at an outside server is enough to make it ask. MITRE ATT&CK records this as T1187 Forced Authentication in the Credential Access tactic (ATT&CK v20, platform Windows). The captured response can be cracked offline or relayed. Server-side coercion through RPC interfaces such as EFSRPC and the Print Spooler is covered in depth in our Authentication Coercion Defence guide; this page covers the rest of T1187, the user-facing lures on workstations, file shares and mail clients, and the controls that stop the user's own hash from leaving the network. It is for Windows engineers, network teams and SOC analysts, and contains no attack procedures.
Key takeaways
- The lure does not need to run code. ATT&CK describes documents that load a remote template, and shortcut or SCF files whose icon points at a remote path, so merely viewing a folder or opening a document can leak a hash.
- Outbound SMB and WebDAV should never reach the internet. ATT&CK M1037 says to block TCP 139 and 445 and UDP 137 at the egress and to filter WebDAV, allowlisting only where external access is essential.
- Windows can now refuse to send NTLM over SMB. Windows 11 24H2 and Windows Server 2025 add the "Block NTLM (LM, NTLM, NTLMv2)" SMB client policy with a server exception list.
- Hash disclosure bugs are patch-now items. CISA's KEV catalogue lists several exploited NTLM hash disclosure flaws in Windows and Outlook, including CVE-2023-23397, CVE-2024-43451 and CVE-2025-24054.
- Detection joins file activity to outbound NTLM. ATT&CK v20 DET0022 correlates a lure file being created or opened with an outbound SMB or WebDAV authentication to an untrusted destination.
What T1187 covers and how this page divides it
ATT&CK explains that when Windows connects to an SMB resource it automatically authenticates with the current user's credentials, and that WebDAV over HTTP on ports 80 and 443 is typically used as a fallback when SMB is blocked or fails. Adversaries exploit this by sending attachments with remote resource links (T1221 Template Injection), placing crafted files on a privileged user's navigation path or on a public share, or calling RPC functions such as EfsRpcOpenFileRaw to make a server authenticate outward. ATT&CK v20 records Dragonfly and DarkHydrus using the technique.
| Variant | Whose credential leaks | Typical result | Where to read |
|---|---|---|---|
| User lure: document, shortcut, SCF, URL file or message | The signed-in user | Offline cracking (T1110.002) or relay | This page |
| RPC coercion of a server (EFSRPC, Print Spooler, DFS) | The server's computer account, often a domain controller | Relay to AD CS or LDAP | Authentication Coercion Defence |
| Name resolution poisoning on the LAN | Any user or host that falls back to LLMNR or NBT-NS | Capture or relay | MITRE ATT&CK T1557 Adversary-in-the-Middle (T1557.001) |
Lure types and their defences
The DET0022 analytic lists the file types most commonly abused (.lnk, .scf, .url, Office documents, PDF and HTML) and the folders where lures work best (Desktop, Public, Downloads, Temp, Start Menu and Startup). The table maps each lure family to the control that breaks it.
| Lure family | What triggers authentication | Control that breaks it |
|---|---|---|
| Office document with a remote template or linked resource | Opening the document, before any macro prompt | Egress block on SMB and WebDAV; SMB client NTLM blocking; see the MITRE ATT&CK T1221 Template Injection |
| Shortcut (.lnk), Shell Command File (.scf) or Internet shortcut (.url) with a remote icon path | Explorer rendering the icon when a folder is viewed | Write restrictions on shared and public folders; file share monitoring; NTLM restriction |
| Files exploiting a hash disclosure vulnerability | Opening or otherwise interacting with the file, depending on the flaw | Prompt patching of KEV-listed hash disclosure flaws |
| Email with a UNC path in a message property | Outlook processing the item (CISA lists CVE-2023-23397 as an exploited example) | Outlook updates; Protected Users for high-value accounts; egress block |
Web page or HTML file referencing a file:// or WebDAV path | Browser or viewer resolving the path | Browser zone settings; WebClient service disabled where not needed; egress block |
Exploited hash disclosure flaws to prioritise
| CVE | CISA KEV name | Added to KEV |
|---|---|---|
| CVE-2023-23397 | Microsoft Office Outlook Privilege Escalation Vulnerability | 14 March 2023 |
| CVE-2024-43451 | Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | 12 November 2024 |
| CVE-2025-24054 | Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability | 17 April 2025 |
CISA describes CVE-2024-43451 as disclosing a user's NTLMv2 hash via a file open operation and CVE-2023-23397 as allowing an NTLM relay attack to authenticate as the user. Treat new entries of this class as emergency patches. See the CISA KEV Catalogue Guide.
Prevention controls
| Control | Setting | Effect and caveats |
|---|---|---|
| Egress filtering (ATT&CK M1037) | Block TCP 139 and 445 and UDP 137 outbound at the perimeter; filter WebDAV; allowlist essential external shares | Stops hashes reaching internet servers; does not stop internal capture from a compromised host |
| Restrict outgoing NTLM | "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" (Audit all, then Deny all) with "Add remote server exceptions for NTLM authentication" | Microsoft advises Audit all first and reviewing the NTLM operational log before Deny all |
| SMB client NTLM blocking | Lanman Workstation policy "Block NTLM (LM, NTLM, NTLMv2)" and "Block NTLM Server Exception List" | Windows 11 24H2 and later and Windows Server 2025 and later; per-mapping blocking also available; the SMB server must allow Kerberos |
| Protected Users group | Add high-value human accounts | Members cannot authenticate with NTLM to the domain; Microsoft warns never to add service or computer accounts and to test before adding privileged group members |
| WebClient service | Disable on servers and on workstations that do not need WebDAV | Removes the HTTP fallback path that bypasses SMB egress blocks |
| Share write control | Remove write access for broad groups on public and departmental shares | Stops planting of icon-based lures where many users browse |
| Password strength (ATT&CK M1027) | Long passphrases, banned password lists | Raises the cost of cracking captured NetNTLM responses; does not stop relay |
Relay protections (SMB signing, LDAP signing and channel binding, Extended Protection for Authentication on AD CS) are what make a captured response useless for relay; they are covered in the NTLM Relay Guide and the SMB Signing Guide.
Decision guidance
- Egress block first, everywhere: it is cheap, rarely breaks business processes and removes the internet-hosted capture server from almost every T1187 scenario.
- SMB client NTLM blocking versus Restrict NTLM: on Windows 11 24H2 and Server 2025 the SMB client policy is the narrower change and is easier to roll out; on older builds use the Restrict NTLM policy in audit mode and work through exceptions.
- Protected Users for people, not services: use it for administrators and executives whose hashes are most valuable; handle service accounts through the NTLM Deprecation and Elimination Guide instead.
- Small organisations: egress block, Outlook and Windows updates, WebClient disabled and shares cleaned up give most of the value without an NTLM audit project.
- Large estates: run the NTLM audit as part of NTLM elimination, since every application found during the audit is also a dependency to fix before NTLM can be retired.
Rolling out the controls
- Confirm egress: test from each workstation and server subnet that TCP 445 and 139 and WebDAV to an external test host are blocked, and record any allowlisted destinations.
- Patch the KEV hash disclosure flaws: confirm the relevant Windows and Outlook updates are installed across the estate.
- Audit outgoing NTLM: set "Outgoing NTLM traffic to remote servers" to Audit all on a pilot group and collect the NTLM operational log centrally.
- Build exceptions: add legitimate NTLM-only servers to the exception policy or to the SMB "Block NTLM Server Exception List".
- Enforce in rings: move to Deny all or enable SMB client NTLM blocking ring by ring, starting with IT and administrator workstations.
- Roll back: both policies can be reverted per ring through Group Policy; keep the exception lists under change control so a rollback does not lose them.
Detection
ATT&CK v20 DET0022 (Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM) describes the chain: a lure is created or modified in a user-exposed location, a user or the system accesses it, the host makes outbound NTLM over SMB or WebDAV to an untrusted destination, and the pattern repeats across users or privileged workstations.
| Signal | Telemetry in DET0022 | Tuning |
|---|---|---|
| Lure created in a user-exposed folder | Sysmon Event ID 11 (file create) | Folder list and file extensions for your estate |
| Access to the lure on shares | Security Event IDs 4656, 4663 and 4670 with object access auditing | Focus on public and widely browsed shares |
| Outbound SMB from workstations | Network flow to TCP 139 and 445 from workstation subnets | Suppress sanctioned file servers; flag workstation to workstation SMB |
| WebDAV with NTLM | HTTP requests carrying NTLMSSP, or PROPFIND, MOVE or OPTIONS with an NTLM Authorization header | Untrusted CIDR and domain lists |
| Correlation | File access followed by outbound NTLM | Correlation window of about 15 to 30 minutes, as DET0022 suggests |
- NTLM operational log: once outgoing NTLM auditing is on, the log under Applications and Services Logs, Microsoft, Windows, NTLM shows which servers receive NTLM, which doubles as a hunting source.
- Firewall denies: blocked outbound 445 attempts are evidence that a lure fired even when nothing leaked.
- Mail items with UNC paths: hunt for messages, calendar items and tasks carrying UNC paths in properties when a mail-borne flaw is announced.
Metrics
- Outbound SMB and WebDAV attempts to the internet blocked per week, and the number of distinct hosts responsible.
- Percentage of Windows endpoints with outgoing NTLM in Deny all or SMB client NTLM blocking enabled.
- Time to install KEV-listed hash disclosure patches after release.
- Number of shares where broad groups have write access, trending down.
- Percentage of administrator accounts in Protected Users.
Response
- Find the lure: identify the file, message or share path and remove it; search for copies across shares and mailboxes.
- List exposed users: use flow logs and the NTLM log to find every account that authenticated to the destination.
- Reset and revoke: reset passwords for exposed accounts, starting with privileged ones, and assume a weak password has already been cracked.
- Check for relay: review authentication from the exposed accounts to other systems in the same window, especially AD CS enrolment and LDAP changes.
- Close the gap: fix the egress rule, patch or policy that allowed the leak before returning to normal.
Where identity fits
Forced authentication turns ordinary user and computer identities into credential sources. Service accounts that browse shares or process files automatically, such as indexing, backup and document conversion services, can render lures without any user present and often have long-lived passwords. Run them with gMSAs where possible, restrict their outbound NTLM, and keep them out of folders that untrusted users can write to.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | M1037 Filter Network Traffic; M1027 Password Policies | Mapped mitigations for T1187 |
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection; SC-7(5) Deny by Default, Allow by Exception | Egress control for SMB and WebDAV |
| NIST SP 800-53 Rev. 5 | CM-7 Least Functionality; SI-2 Flaw Remediation; SI-4 System Monitoring | WebClient and NTLM restriction, patching, detection |
| NIST CSF 2.0 | PR.AA-03; PR.PS-01; DE.CM-01 | Authentication, configuration, network monitoring |
Common failure patterns
- SMB blocked, WebDAV open: the WebClient service carries the authentication over HTTP and the egress rule never sees port 445.
- Egress only at the perimeter: a compromised internal host acts as the capture server and receives hashes over the LAN.
- Writable public shares: one planted shortcut collects hashes from everyone who opens the folder, including administrators.
- Deny all without an audit phase: applications break, the policy is rolled back across the estate and never returns.
- Treating the patch as the fix: the next hash disclosure flaw needs the same egress and NTLM controls to be in place already.
Practitioner checklist
- Block outbound TCP 139 and 445, UDP 137 and WebDAV to the internet and test it from every subnet.
- Install Windows and Outlook updates for KEV-listed NTLM hash disclosure flaws as emergency changes.
- Audit outgoing NTLM, build exceptions, then enforce Deny all or SMB client NTLM blocking.
- Disable the WebClient service where WebDAV is not needed.
- Remove broad write access from public and departmental shares.
- Place administrators and executives in Protected Users after testing.
- Correlate lure file activity with outbound NTLM in the SIEM, per DET0022.
- Reset exposed accounts and check for relay activity after any confirmed leak.
Standards and references
- MITRE ATT&CK: Forced Authentication (T1187)
- Microsoft Learn: Block NTLM connections on SMB
- Microsoft Learn: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
- Microsoft Learn: Protected Users security group
- CISA: Known Exploited Vulnerabilities Catalog
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Authentication Coercion Defence · NTLM Relay Guide · NTLM Deprecation and Elimination Guide · SMB Protocol Security and Signing Guide