detection.wiki

Detection rules › Sigma

NTLM Hash Leak Via Curl NTLM Authentication

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1187 Forced Authentication

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: NTLM Hash Leak Via Curl NTLM Authentication
id: 916eb839-895e-47f8-99ee-3008bf377a3e
status: test
description: |
    Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an
    attacker-controlled server, enabling offline cracking or relay attacks.
    When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials
    stored in LSASS — without requiring a plaintext password.
    This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.
references:
    - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
    - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
    - https://curl.se/docs/manpage.html#--ntlm
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-06-04
tags:
    - attack.credential-access
    - attack.t1187
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\curl.exe'
        - OriginalFileName: 'curl.exe'
    selection_ntlm_flag:
        CommandLine|contains: '--ntlm'
    selection_empty_creds:
        CommandLine|re: '(?i)\s(-u|--user)\s*:'
    condition: all of selection_*
falsepositives:
    - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\curl.exe'
    - OriginalFileName: 'curl.exe'

Stage 2: selection_ntlm_flag

selection_ntlm_flag:
    CommandLine|contains: '--ntlm'

Stage 3: selection_empty_creds

selection_empty_creds:
    CommandLine|re: '(?i)\s(-u|--user)\s*:'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • --ntlm
CommandLineregex_match
  • (?i)\s(-u|--user)\s*:
Imageends_with
  • \curl.exe corpus 30 (sigma 30)
OriginalFileNameeq
  • curl.exe corpus 15 (sigma 12, splunk 3)