Suspicious Windows Search URI NTLM Leak

Danny Y@zendannyy

•updated Jun 7, 2026•6•0•17

Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool. Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec