Detectionmediumtest
Renamed CURL.EXE Execution
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
X__Junior (Nextron Systems)Created Mon Sep 11Updated Thu Oct 127530cd3d-7671-43e3-b209-976966f6ea48windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection:
- OriginalFileName: 'curl.exe'
- Description: 'The curl executable'
filter_main_img:
Image|contains: '\curl'
condition: selection and not 1 of filter_main_*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Rule Metadata
Rule ID
7530cd3d-7671-43e3-b209-976966f6ea48
Status
test
Level
medium
Type
Detection
Created
Mon Sep 11
Modified
Thu Oct 12
Path
rules/windows/process_creation/proc_creation_win_renamed_curl.yml
Raw Tags
attack.executionattack.t1059attack.defense-evasionattack.t1202