Detectionmediumtest

Curl Web Request With Potential Custom User-Agent

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Thu Jul 27Updated Thu Dec 1185de1f22-d189-44e4-8239-dc276b45379bwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    # Example: This command line would trigger the rule
    # curl.exe -H "User-Agent: EvilAgent" http://malicious.example.com
    selection_img:
        - Image|endswith: '\curl.exe'
        - OriginalFileName: 'curl.exe'
    selection_header_flag_1:
        CommandLine|re: '\s-H\s' # Must be Regex as the flag needs to be case sensitive
    selection_header_flag_2:
        CommandLine|contains: '--header'
    selection_user_agent:
        CommandLine|contains: 'User-Agent:'
    condition: selection_img and 1 of selection_header_* and selection_user_agent