[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

detection guidance built from Microsoft's CVE-2026-124194 description; Microsoft has not published IOCs or attack details

Hunt: Outlook reaching out over SMB or WebDAV to an outside host right after a user opens a message file

  • Network: OUTLOOK.EXE (or the WebClient service, svchost hosting WebClient, for WebDAV) opening TCP 445, 139 or 80/443 WebDAV connections to internet addresses. Workstations shouldn't speak SMB to the internet at all, so any allowed outbound 445 is a lead.
  • Files: .msg or other Outlook item attachments delivered from external senders, and Outlook opening a file from %TEMP% or the Outlook secure temp folder (Content.Outlook) shortly before the outbound connection.
  • Authentication: with outgoing NTLM auditing enabled, Microsoft-Windows-NTLM/Operational events show NTLM sent to remote servers; look for targets that are IP addresses or domains outside your estate.
  • Follow-on: logons for the same user from new IPs or relayed NTLM authentications to internal services (Exchange, ADCS web enrollment, SMB servers without signing) soon after.
  • If you find a hit, reset the user's password; a captured NTLMv2 response can be cracked offline.

Sources: MSRC Security Update Guide: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability · Microsoft Learn: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers