feat(rules): Add Potential NTLM hash leak via MS Photos rule

Detects a potential NTLM hash disclosure via abuse of the ms-photos: URIscheme with a UNC path parameter. An attacker can craft a specially formatted link that, when opened, launches Microsoft Photos directly from a browser and triggers outbound authentication, potentially leaking NTLM credentials.

Author: rabbitstack

rules/credential_access_potential_ntlm_hash_leak_via_ms_photos.yml

@@ -0,0 +1,37 @@
+name: Potential NTLM hash leak via MS Photos
+id: b5b70c6d-e265-477e-bd62-b4d05089e2ab
+version: 1.0.0
+description: |
+  Detects a potential NTLM hash disclosure via abuse of the ms-photos: URI
+  scheme with a UNC path parameter. An attacker can craft a specially formatted
+  link that, when opened, launches Microsoft Photos directly from a browser and
+  triggers outbound authentication, potentially leaking NTLM credentials.
+labels:
+  tactic.id: TA0006
+  tactic.name: Credential Access
+  tactic.ref: https://attack.mitre.org/tactics/TA0006/
+  technique.id: T1187
+  technique.name: Forced Authentication
+  technique.ref: https://attack.mitre.org/techniques/T1187/
+references:
+  - https://github.com/rubenformation/ms-photos_NTLM_Leak
+
+condition: >
+  sequence
+  maxspan 1m
+    |spawn_process and
+     ps.parent.name ~= 'explorer.exe' and ps.name ~= 'Photos.exe' and
+     ps.cmdline imatches '*ms-photos:viewer?fileName=%5C%5C*%5C*%5C*'
+    |
+    |connect_socket and
+     evt.pid = 4 and net.dport = 445 and not cidr_contains(net.dip,
+                                                  '127.0.0.0/8',
+                                                  '10.0.0.0/8',
+                                                  '172.16.0.0/12', '192.168.0.0/16')
+    |
+
+output: >
+  Potential NTLM hash leak via MS Photos UNC path at address $2.net.dip
+severity: high
+
+min-engine-version: 3.0.0