Email with Windows Search URI Scheme for NTLM Leak

Ethan Andrews@eandrews

•updated Jun 3, 2026•12•0•28

Detects the presence of 'search:' or 'search-ms:' URI schemes embedded in inbound emails. These schemes can be abused to force outbound NTLM authentication and leak Net-NTLMv2 hashes via a single link click.