CVE-2025-59775

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName =~ "httpd.exe" or InitiatingProcessFileName =~ "apache.exe"
| where RemotePort == 445 or RemotePort == 139 // SMB/NetBIOS ports
| where RemoteIP !in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") // Exclude private IPs
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| join kind=leftouter (
    DeviceLogonEvents
    | where ActionType == "NtlmLogon"
    | where Protocol == "NTLM"
    | where RemoteIP !in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") // Exclude private IPs
    | project TimeGenerated, DeviceName, RemoteIP, AccountName, TargetDeviceName
) on DeviceName, RemoteIP
| where isnotempty(AccountName)
| extend Description = "Potential NTLM hash leakage via Apache SSRF on Windows"

Splunk SPL

(sourcetype=WinEventLog:Security EventCode=4624 OR EventCode=4648) OR (sourcetype=apache_access_log OR sourcetype=apache_error_log)
| eval is_apache_process = if(match(_raw, "httpd.exe|apache.exe"), "true", "false")
| eval is_ntlm_logon = if(EventCode=4624 AND AuthenticationPackage="NTLM", "true", "false")
| eval is_network_connection = if(EventCode=5156 AND DestPort IN (445, 139), "true", "false")
| where is_apache_process="true" OR is_ntlm_logon="true" OR is_network_connection="true"
| search NOT (dest_ip=10.* OR dest_ip=172.16.* OR dest_ip=172.17.* OR dest_ip=172.18.* OR dest_ip=172.19.* OR dest_ip=172.20.* OR dest_ip=172.21.* OR dest_ip=172.22.* OR dest_ip=172.23.* OR dest_ip=172.24.* OR dest_ip=172.25.* OR dest_ip=172.26.* OR dest_ip=172.27.* OR dest_ip=172.28.* OR dest_ip=172.29.* OR dest_ip=172.30.* OR dest_ip=172.31.* OR dest_ip=192.168.*)
| stats count by _time, host, user, src_ip, dest_ip, dest_port, is_apache_process, is_ntlm_logon, is_network_connection, _raw
| rename _raw as raw_log
| eval Description = "Potential NTLM hash leakage via Apache SSRF on Windows"

Sigma

title: Apache NTLM Leakage via SSRF
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential NTLM hash leakage on Apache HTTP Server on Windows through SSRF by monitoring outbound SMB connections from Apache processes to external IPs.
author: SecBoard
date: 2025/12/04
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection_process:
    Image|endswith:
      - '\httpd.exe'
      - '\apache.exe'
  selection_network:
    EventID: 3
    DestinationPort:
      - 445
      - 139
    Initiated: 'true'
  filter_private_ip:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
  condition: selection_process and selection_network and not filter_private_ip
  falsepositives:
    - Legitimate Apache integrations with external SMB shares (should be whitelisted)
level: high

Elastic ES|QL

from network where process.name in ("httpd.exe", "apache.exe") and (destination.port == 445 or destination.port == 139) and not cidrMatch("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", destination.ip)
| join by host.name
  (from windows.event.log where event.code == 4624 and winlog.logon.authentication_package == "NTLM" and not cidrMatch("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", source.ip))
| where not is_empty(winlog.logon.authentication_package)
| select @timestamp, host.name, process.name, destination.ip, destination.port, winlog.logon.user.name, "Potential NTLM hash leakage via Apache SSRF on Windows" as description