Windows: .library-ms File Creation by 7z/WinRAR/Explorer

Alerts on .library-ms file creation triggered by 7z.exe, winrar.exe, or explorer.exe, which may indicate forced-authentication style exploitation.

FreeUnreviewedSigmamediumv1

windows-library-ms-file-creation-by-7z-winrar-explorer-5a7132c0

title: "Windows: .library-ms File Creation by 7z/WinRAR/Explorer"
id: 7488722a-d654-48c5-a3ea-1b5e9692eff1
status: experimental
description: This rule flags creation of .library-ms files when the creating process is 7z.exe, winrar.exe, or explorer.exe. Attackers may use these files to induce forced authentication behavior when archives are processed, potentially leading to credential exposure to a remote server. It relies on Windows file event telemetry that records the target filename and the originating process image.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
  - https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml
author: Gene Kazimiarovich, Huntrule Team
date: 2025-04-20
tags:
  - detection.emerging-threats
  - attack.credential-access
  - attack.t1187
  - cve.2025-24054
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .library-ms
    Image|endswith:
      - \7z.exe
      - \winrar.exe
      - \explorer.exe
  condition: selection
falsepositives:
  - Legitimate Library shortcuts under %APPDATA%\Microsoft\Windows\Libraries\ (rarely created by end-users)
  - Custom corporate scripts that programmatically generate .library-ms Files
level: medium
license: DRL-1.1
related:
  - id: 5a7132c0-86db-4e6b-95c0-f0e9d7f461aa
    type: derived

What it detects

This rule flags creation of .library-ms files when the creating process is 7z.exe, winrar.exe, or explorer.exe. Attackers may use these files to induce forced authentication behavior when archives are processed, potentially leading to credential exposure to a remote server. It relies on Windows file event telemetry that records the target filename and the originating process image.

Known false positives

Legitimate Library shortcuts under %APPDATA%\Microsoft\Windows\Libraries\ (rarely created by end-users)
Custom corporate scripts that programmatically generate .library-ms Files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.