NTLM Hash Leak Via Curl NTLM Authentication — Sigma Rule

Rule metadata and linked tags

Author: Swachchhanda Shrawan Poudel (Nextron Systems). Source status: test; severity: high. Source dates: 2026-06-04 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: c4e8ad87ccffbeeb5f36a4366cadb0dd6e08de35227813d9d58e7a4a2b56d0df

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: NTLM Hash Leak Via Curl NTLM Authentication
id: 916eb839-895e-47f8-99ee-3008bf377a3e
status: test
description: |
    Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an
    attacker-controlled server, enabling offline cracking or relay attacks.
    When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials
    stored in LSASS — without requiring a plaintext password.
    This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.
references:
    - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
    - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
    - https://curl.se/docs/manpage.html#--ntlm
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-06-04
tags:
    - attack.credential-access
    - attack.t1187
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\curl.exe'
        - OriginalFileName: 'curl.exe'
    selection_ntlm_flag:
        CommandLine|contains: '--ntlm'
    selection_empty_creds:
        CommandLine|re: '(?i)\s(-u|--user)\s*:'
    condition: all of selection_*
falsepositives:
    - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml

Original YAML and metadata in JSON

False positives

• Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.

Source references

• https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
• https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
• https://curl.se/docs/manpage.html#--ntlm