Windows Search URI Handler NTLM Leak V2

Aamir Muhammad@Aamir

•updated Jun 8, 2026•2•0•11

This rule detects attempts to exploit a vulnerability in the Windows Search URI handler that can lead to NTLM credential leaks. It specifically looks for network events where the `RemoteUrl` contains 'search:' or 'search-ms:' along with parameters like 'query=' or 'crumb='. This indicates an attempt to trigger the Windows Search functionality with crafted URI parameters, which could force the system to authenticate to an attacker-controlled server using NTLM.