Sigma rule: NTLM Hash Leak Via Curl NTLM Authentication

Rule

Title

NTLM Hash Leak Via Curl NTLM Authentication

Status

test

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-06-04

File

rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an
attacker-controlled server, enabling offline cracking or relay attacks.
When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials
stored in LSASS — without requiring a plaintext password.
This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\curl.exe'
    - OriginalFileName: 'curl.exe'
selection_ntlm_flag:
    CommandLine|contains: '--ntlm'
selection_empty_creds:
    CommandLine|re: '(?i)\s(-u|--user)\s*:'
condition: all of selection_*

False positives (as the rule lists them)

• Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.

Tags

• attack.credential-access
• attack.t1187

MITRE ATT&CK ids this rule names

• T1187

References

• https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
• https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
• https://curl.se/docs/manpage.html#--ntlm

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml