Fellows on Nostr: If you haven’t noticed malicious emails abusing Microsoft Library Description files ...

If you haven’t noticed malicious emails abusing Microsoft Library Description files (.library-ms), watch out and block them.

From Microsoft “Library description files are XML files that define libraries. Libraries aggregate items from local and remote storage locations into a single view in Windows Explorer.”

Threat actors, in an effort to evade detection, use them as a way of connecting their target to a remote share directly via File Explorer.

https://learn.microsoft.com/en-us/windows/win32/shell/library-schema-entry

#ThreatIntel