How to Protect Your Environment From the NTLM Vulnerability

A zero-day in NTLM discovered by 0patch enables attackers to exfiltrate NTLM password hashes when a user merely views a crafted file in Windows Explorer, affecting Windows 7/Server 2008 R2 through Windows 11/Server 2022; captured hashes can be used for relay, pass-the-hash, or offline cracking. The report outlines mitigations including enabling Extended Protection for Authentication (EPA), LDAP channel binding, SMB signing/encryption, Group Policy auditing/restrictions for NTLM, monitoring for legacy clients, and migrating to Kerberos plus MFA.