Windows Suspicious .library-ms File Creation by 7z.exe, winrar.exe, or explorer.exe
Alerts on .library-ms file creation triggered by 7z.exe, winrar.exe, or explorer.exe, which may indicate forced-authentication style exploitation.
- Product
- windows
- Category
- file_event
- Author
- Gene Kazimiarovich (SigmaHQ), DRL 1.1
- Published
- 2025-04-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation events for files ending in .library-ms when the creating process is 7z.exe, winrar.exe, or explorer.exe. Attackers may use .library-ms shortcuts to trigger forced authentication behavior during archive extraction, potentially leading to exposure of authentication material. It relies on Windows file event telemetry that includes the target filename and the process image that created it.
Reporting behind it
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
- research.checkpoint.comhttps://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious .library-ms File Creation by 7z.exe, winrar.exe, or explorer.exe
id: 7488722a-d654-48c5-a3ea-1b5e9692eff1
status: experimental
description: This rule flags Windows file creation events for files ending in .library-ms when the creating process is 7z.exe, winrar.exe, or explorer.exe. Attackers may use .library-ms shortcuts to trigger forced authentication behavior during archive extraction, potentially leading to exposure of authentication material. It relies on Windows file event telemetry that includes the target filename and the process image that created it.
references:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
- https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml
author: Gene Kazimiarovich, Huntrule Team
date: 2025-04-20
tags:
- detection.emerging-threats
- attack.credential-access
- attack.t1187
- cve.2025-24054
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: .library-ms
Image|endswith:
- \7z.exe
- \winrar.exe
- \explorer.exe
condition: selection
falsepositives:
- Legitimate Library shortcuts under %APPDATA%\Microsoft\Windows\Libraries\ (rarely created by end-users)
- Custom corporate scripts that programmatically generate .library-ms Files
level: medium
license: DRL-1.1
related:
- id: 5a7132c0-86db-4e6b-95c0-f0e9d7f461aa
type: derived