should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with ntlm authentication and empty credentials, such as in certain scripts or automation tasks.

t1187
windows
sigma

Techniques

t1187

Sample rules

NTLM Hash Leak Via Curl NTLM Authentication

source: sigma
technicques:
- t1187

Description

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user’s NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user’s logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

Detection logic

condition: all of selection_*
selection_empty_creds:
  CommandLine|re: '(?i)\s(-u|--user)\s*:'
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_ntlm_flag:
  CommandLine|contains: --ntlm