{"id":"916eb839-895e-47f8-99ee-3008bf377a3e","title":"NTLM Hash Leak Via Curl NTLM Authentication","description":"Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an\nattacker-controlled server, enabling offline cracking or relay attacks.\nWhen no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials\nstored in LSASS — without requiring a plaintext password.\nThis behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2026-06-04","modified":"","tags":["attack.credential-access","attack.t1187"],"technique_ids":["T1187"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks."],"references":["https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140","https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm","https://curl.se/docs/manpage.html#--ntlm"],"source_path":"rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml","source_sha256":"c4e8ad87ccffbeeb5f36a4366cadb0dd6e08de35227813d9d58e7a4a2b56d0df","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: NTLM Hash Leak Via Curl NTLM Authentication\nid: 916eb839-895e-47f8-99ee-3008bf377a3e\nstatus: test\ndescription: |\n    Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an\n    attacker-controlled server, enabling offline cracking or relay attacks.\n    When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials\n    stored in LSASS — without requiring a plaintext password.\n    This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.\nreferences:\n    - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140\n    - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm\n    - https://curl.se/docs/manpage.html#--ntlm\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-06-04\ntags:\n    - attack.credential-access\n    - attack.t1187\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\curl.exe'\n        - OriginalFileName: 'curl.exe'\n    selection_ntlm_flag:\n        CommandLine|contains: '--ntlm'\n    selection_empty_creds:\n        CommandLine|re: '(?i)\\s(-u|--user)\\s*:'\n    condition: all of selection_*\nfalsepositives:\n    - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1187","id":"T1187","name":"Forced Authentication","page":"techniques/enterprise/T1187/"}],"data_path":"data/detection-rules/916eb839-895e-47f8-99ee-3008bf377a3e.json","kind":"sigma"}