Tag
Potential NetNTLMv1 Downgrade Attack via Registry Modification
2 rules 2 TTPsThis brief details a registry modification attack that downgrades the system to NTLMv1 authentication, enabling NetNTLMv1 downgrade attacks, typically performed with local administrator privileges on Windows systems.
SiYuan Zero-Click NTLM Theft and Blind SSRF via Mermaid Diagrams
2 rules 3 TTPs 1 CVESiYuan is vulnerable to zero-click NTLM hash theft on Windows and blind SSRF on all platforms due to insecure Mermaid.js configuration, where a malicious Mermaid diagram containing a protocol-relative URL can be injected into a note, causing the Electron client to fetch the URL, triggering SMB authentication on Windows and sending the victim's NTLMv2 hash to the attacker. On macOS and Linux, the request acts as a tracking pixel and blind SSRF.
Detecting Rare SMB Connections for Potential NTLM Credential Theft
2 rules 2 TTPsThis brief details a detection strategy for rare SMB connections originating from internal networks to the internet, potentially indicating NTLM credential theft via rogue UNC path injection.