Detecting Outlook NTLM Credential Theft via Child Processes and Outbound SMB Auth
Outlook abused to leak Net-NTLMv2 responses is a credential-theft problem, not just a patch-management one. This short walks the detection side: the mail-level reference that makes Outlook authenticate to an attacker-chosen UNC or WebDAV path, the child processes worth hunting under OUTLOOK.EXE, and a KQL summary that surfaces the rare command lines first. It also covers why the captured material is a relay primitive rather than a hash you can pass around, and the controls that sit in front of the patch — SMB signing, disabling WebClient where it isn't needed, and blocking outbound SMB at the edge. Note on sourcing: the public reporting does not include a CVE ID, an affected build range or a root cause, so nothing here is keyed to a guessed version. Check the Microsoft Security Update Guide for the authoritative record before you write detection content. Full write-up: https://hackyjs.com/posts/detecting-outlook-ntlm-credential-theft-via-child-processes-and-outbound-smb-auth