Query: write Sigma for Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently
Matching passage: Sigma rule: Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently. Logsource: windows / process_creation. Rule: title: NTLM Hash Leak Via Curl NTLM Authentication id: 916eb839-895e-47f8-99ee-3008bf377a3e status: test description: 'Detects the use of curl with NTLM authentication and empty credentials (-u :), which can be abused to leak the currently logged-in user''s NTLMv2 challenge-response to an attacker-controlled server, enabling offline cracking or relay attacks. When no credentials are provided, the Microsoft-shipped curl passes a NULL identity to Windows SSPI, which automatically falls back to the current user''s logon session credentials stored in LSASS — without requiring a plaintext password. This behavior is exclusive to the curl binary shipped by Microsoft (available since Windows 10 / Windows Server 2019), which is built with SSPI support. ' references: - https://github.com/curl/curl/blob/master/lib/vauth/ntlm_sspi.c#L128-L140 - https://learn.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--ntlm - https://curl.se/docs/manpage.html#--ntlm author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-06-04 tags: - attack.credential-access - attack.t1187 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ntlm_flag: CommandLine|contains: --ntlm selection_empty_creds: CommandLine|re: '(?i)\s(-u|--user)\s*:' condition: all of selection_* falsepositives: - Should be very rare as it's not widely known or used, but could occur in legitimate use cases where curl is used with NTLM authentication and empty credentials, such as in certain scripts or automation tasks. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt/info.yml
Near-miss passage: Sigma rule: Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Netw. Logsource: cisco / aaa. Rule: title: Cisco Dot1x Disabled id: ef0ff092-a24a-4fbc-beea-06c08d53e085 status: experimental description: 'Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices. ' references: - https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680 - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400 - https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220 author: Luc Génaux date: 2026-04-28 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1685 - attack.t1556.004 logsource: product: cisco service: aaa detection: keywords: - access-session port-control force-authorized - authentication port-control force-authorized - dot1x port-control force-authorized - no access-session port-control - no authentication port-control - no dot1x port-control - no dot1x system-auth-control condition: keywords falsepositives: - Administrator troubleshooting connectivity issues level: medium