NTLM Hash Leak Via Curl NTLM Authentication

SIGMA detection rule by Swachchhanda Shrawan Poudel (Nextron Systems) · GPL-2.0

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

title: NTLM Hash Leak Via Curl NTLM Authentication
id: daa6dc1b-6708-933d-5c9d-6e17fb61552a
related:
    - id: 916eb839-895e-47f8-99ee-3008bf377a3e
      type: derived
status: test
description: |
    Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an
    attacker-controlled server, enabling offline cracking or relay attacks.
    When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials
    stored in LSASS — without requiring a plaintext password.
    This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.
references:
    - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
    - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
    - https://curl.se/docs/manpage.html#--ntlm
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-06-04
tags:
    - attack.credential-access
    - attack.t1187
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_img:
        - NewProcessName|endswith: \curl.exe
        - OriginalFileName: curl.exe
    selection_ntlm_flag:
        CommandLine|contains: --ntlm
    selection_empty_creds:
        CommandLine|re: '(?i)\s(-u|--user)\s*:'
    condition: process_creation and (all of selection_*)
falsepositives:
    - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

319af57b-e557-4a98-ba3d-1fb235f4e40f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion