ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)

alert tcp any any -> $HOME_NET any (
    msg:"ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)";
    flow:established,to_client;
    file.data;
    content:"|5b|InternetShortcut"; fast_pattern;
    pcre:"/^(?:\x2e[AW])\x5d/R";
    content:"|3d 5c 5c 5c 5c|";
    reference:url,research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/;
    reference:cve,2024-43451;
    classtype:attempted-user;
    sid:2062313; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2025_05_13, cve CVE_2024_43451, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_05_13;
    target:dest_ip;
)