T1187 — Forced Authentication

Tactic: Credential Access · Platforms: Windows

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between…

Sigma detection rules (1)

T1187 Forced Authentication

title: T1187 Forced Authentication
id: 834891d8-0576-48ca-954a-2ca9facbbacc
description: 'Detects creation of lure files with extensions (.scf, .url, .lnk, .searchConnector-ms) commonly used to force automatic SMB/WebDAV NTLM authentication when a victim browses the containing folder. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: UserLocations, LureExtensions, UntrustedCIDR/DNS, TimeWindow, WorkstationZones, OfficeTemplatePaths.'
references:
  - https://attack.mitre.org/techniques/T1187
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.credential-access
  - attack.t1187

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 11
    TargetFilename|endswith:
      - '.scf'
      - '.url'
      - '.lnk'
      - '.searchConnector-ms'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate shortcut/URL file creation by installers, browsers, or users.

level: medium

Explore