NTLM Hash Leak Via Curl NTLM Authentication

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user's NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user's logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support.

2026-06-04 00:00:00

None

916eb839-895e-47f8-99ee-3008bf377a3e

attack.credential-access attack.t1187

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #6049 from @swachchhanda000 - Add `NTLM Hash Leak Via Curl NTLM Authentication`

2026-06-11