Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Suspicious Curl Change User Agents - Linux

Detects a suspicious curl process start on linux with set useragent options

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Thu Sep 15b86d356d-6093-443d-971c-9b07db583c68linux
Log Source
LinuxProcess Creation
ProductLinux← raw: linux
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        Image|endswith: '/curl'
        CommandLine|contains:
            - ' -A '
            - ' --user-agent '
    condition: selection
False Positives

Scripts created by developers and admins

Administrative activity

References
1
Resolving title…
curl.se
MITRE ATT&CK
Related Rules
DerivedThreat Huntmedium

Curl.EXE Execution With Custom UserAgent

Detects execution of curl.exe with custom useragent options

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
b86d356d-6093-443d-971c-9b07db583c68
Status
test
Level
medium
Type
Detection
Created
Thu Sep 15
Author
Nasreddine Bencherchali (Nextron Systems)
Path
rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml
Raw Tags
attack.command-and-controlattack.t1071.001
View on GitHub