AN0065 Analytic 0065

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Adversary stages a lure that references a remote resource (e.g., LNK/SCF/Office template). When the user opens/renders the file or a shell enumerates icons, the host automatically attempts SMB or WebDAV authentication to the attacker host. The chain is: (1) lure file is created or modified in a user-exposed location → (2) user or system accesses the lure → (3) host makes outbound NTLM (SMB 139/445 or WebDAV over 80/443) to an untrusted destination → (4) repeated attempts from multiple users/hosts or from privileged workstations.</p>

Detects: T1187 Forced Authentication
Part of: DET0022 Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Sysmon	`EventCode=11`	DC0039 File Creation
WinEventLog:Security	`EventCode=4663, 4670, 4656`	DC0061 File Modification
NSM:Flow	`HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM`	DC0085 Network Traffic Content
NSM:Flow	`Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets`	DC0078 Network Traffic Flow

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`UserLocations`	Folders where lures are most effective (Desktop, Public, Downloads, Temp, Cache, Start Menu, Startup). Adjust to enterprise layout.
`LureExtensions`	File types commonly abused (.lnk, .scf, .url, .doc/.xls/.ppt/.pdf/.html). Extend for your tooling and languages.
`UntrustedCIDR/DNS`	Org-specific list of external/unknown networks or domains; used to suppress sanctioned file servers and WebDAV gateways.
`TimeWindow`	Correlation horizon (e.g., 15–30 minutes) between file access and outbound NTLM attempt.
`WorkstationZones`	Asset/zone tags that distinguish workstations from servers; helps flag workstation→workstation SMB, which is often abnormal.
`OfficeTemplatePaths`	Paths to Office templates to catch template injection references and abnormal loads.