Phoenix
Sigma IntelligenceBeta
Back to Rules
Threat Huntlowtest

Curl.EXE Execution

Detects a curl process start on Windows, which could indicates a file download from a remote location or a simple web request to a remote server

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Tue Jul 05Updated Tue Feb 21bbeaed61-1990-4773-bf57-b81dbad7db2dwindows
Hunting Hypothesis
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        - Image|endswith: '\curl.exe'
        - Product: 'The curl executable'
    condition: selection
False Positives

Scripts created by developers and admins

Administrative activity

References
1
Resolving title…
web.archive.org
MITRE ATT&CK

Other

detection.threat-hunting
Related Rules
DerivedDetectionhigh

Suspicious Curl.EXE Download

Detects a suspicious curl process start on Windows and outputs the requested document to a local file

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
bbeaed61-1990-4773-bf57-b81dbad7db2d
Status
test
Level
low
Type
Threat Hunt
Created
Tue Jul 05
Modified
Tue Feb 21
Author
Florian Roth (Nextron Systems)
Path
rules-threat-hunting/windows/process_creation/proc_creation_win_curl_execution.yml
Raw Tags
attack.command-and-controlattack.t1105detection.threat-hunting
View on GitHub