Windows Search URI Handler NTLM Leak V2

Aamir Muhammad@Aamir

•updated Jun 8, 2026•3•0•12

Detects attempts to exploit the Windows Search URI handler vulnerability (CVE-2023-29357) which can lead to NTLM credential leaks. This rule specifically looks for process command lines that invoke the 'search' or 'search-ms' URI scheme with a 'crumb=location:' parameter pointing to an UNC path, indicating an attempt to coerce NTLM authentication.