Windows curl with NTLM and empty user credentials can leak current user NTLMv2 responses

title: Windows curl with NTLM and empty user credentials can leak current user NTLMv2 responses
id: 35ca0591-f93e-4cc9-8825-a43f27b32a2a
status: test
description: "This rule flags process creation events where curl.exe is invoked with the --ntlm option and an empty credential specified as -u : or --user :. In this configuration, curl can cause Windows SSPI to use the currently logged-in session credentials, resulting in the user’s NTLMv2 challenge-response being sent to an attacker-controlled destination. The detection relies on telemetry from Windows process creation, matching curl.exe execution, the NTLM flag in the command line, and the empty-credential pattern in -u/--user."
references:
  - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
  - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
  - https://curl.se/docs/manpage.html#--ntlm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-06-04
tags:
  - attack.credential-access
  - attack.t1187
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_ntlm_flag:
    CommandLine|contains: --ntlm
  selection_empty_creds:
    CommandLine|re: "(?i)\\s(-u|--user)\\s*:"
  condition: all of selection_*
falsepositives:
  - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml
license: DRL-1.1
related:
  - id: 916eb839-895e-47f8-99ee-3008bf377a3e
    type: derived