Windows Process Creation: curl.exe Using NTLM with Empty Username (-u :)
Alerts when curl is run on Windows with --ntlm and empty -u : credentials, a pattern that may leak the current user's NTLMv2 response.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-06-04
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of Microsoft curl on Windows where the process uses NTLM authentication and specifies empty credentials using the -u : / --user : pattern. That combination can cause Windows SSPI to use the current user’s logon session credentials, enabling exposure of NTLMv2 challenge-response material to an attacker-controlled server for offline cracking or relay. Detection relies on process creation telemetry containing the Image/OriginalFileName and the command line including --ntlm and the empty -u : user format.
Reporting behind it
- github.comhttps://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
- curl.sehttps://curl.se/docs/manpage.html#--ntlm
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: curl.exe Using NTLM with Empty Username (-u :)"
id: 35ca0591-f93e-4cc9-8825-a43f27b32a2a
status: test
description: "This rule identifies executions of Microsoft curl on Windows where the process uses NTLM authentication and specifies empty credentials using the -u : / --user : pattern. That combination can cause Windows SSPI to use the current user’s logon session credentials, enabling exposure of NTLMv2 challenge-response material to an attacker-controlled server for offline cracking or relay. Detection relies on process creation telemetry containing the Image/OriginalFileName and the command line including --ntlm and the empty -u : user format."
references:
- https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140
- https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm
- https://curl.se/docs/manpage.html#--ntlm
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-06-04
tags:
- attack.credential-access
- attack.t1187
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_ntlm_flag:
CommandLine|contains: --ntlm
selection_empty_creds:
CommandLine|re: "(?i)\\s(-u|--user)\\s*:"
condition: all of selection_*
falsepositives:
- Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml
license: DRL-1.1
related:
- id: 916eb839-895e-47f8-99ee-3008bf377a3e
type: derived