Windows Suspicious .library-ms File Creation by 7z.exe, winrar.exe, or explorer.exe

title: Windows Suspicious .library-ms File Creation by 7z.exe, winrar.exe, or explorer.exe
id: 7488722a-d654-48c5-a3ea-1b5e9692eff1
status: experimental
description: This rule flags Windows file creation events for files ending in .library-ms when the creating process is 7z.exe, winrar.exe, or explorer.exe. Attackers may use .library-ms shortcuts to trigger forced authentication behavior during archive extraction, potentially leading to exposure of authentication material. It relies on Windows file event telemetry that includes the target filename and the process image that created it.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
  - https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml
author: Gene Kazimiarovich, Huntrule Team
date: 2025-04-20
tags:
  - detection.emerging-threats
  - attack.credential-access
  - attack.t1187
  - cve.2025-24054
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .library-ms
    Image|endswith:
      - \7z.exe
      - \winrar.exe
      - \explorer.exe
  condition: selection
falsepositives:
  - Legitimate Library shortcuts under %APPDATA%\Microsoft\Windows\Libraries\ (rarely created by end-users)
  - Custom corporate scripts that programmatically generate .library-ms Files
level: medium
license: DRL-1.1
related:
  - id: 5a7132c0-86db-4e6b-95c0-f0e9d7f461aa
    type: derived