{"id":"00b90cc1-17ec-402c-96ad-3a8117d7a582","title":"Suspicious Curl File Upload - Linux","description":"Detects a suspicious curl process start the adds a file to a web request","author":"Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)","status":"test","level":"medium","date":"2022-09-15","modified":"2023-05-02","tags":["attack.exfiltration","attack.command-and-control","attack.t1567","attack.t1105"],"technique_ids":["T1105","T1567"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Scripts created by developers and admins"],"references":["https://twitter.com/d1r4c/status/1279042657508081664","https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file","https://curl.se/docs/manpage.html","https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml","source_sha256":"d4e05d83b666d4ee1066ac434304d8cca6963898ca6ac0731d5ec929a8589a1a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Curl File Upload - Linux\nid: 00b90cc1-17ec-402c-96ad-3a8117d7a582\nrelated:\n    - id: 00bca14a-df4e-4649-9054-3f2aa676bc04\n      type: derived\nstatus: test\ndescription: Detects a suspicious curl process start the adds a file to a web request\nreferences:\n    - https://twitter.com/d1r4c/status/1279042657508081664\n    - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file\n    - https://curl.se/docs/manpage.html\n    - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)\ndate: 2022-09-15\nmodified: 2023-05-02\ntags:\n    - attack.exfiltration\n    - attack.command-and-control\n    - attack.t1567\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img:\n        Image|endswith: '/curl'\n    selection_cli:\n        - CommandLine|contains:\n              - ' --form' # Also covers the \"--form-string\"\n              - ' --upload-file '\n              - ' --data '\n              - ' --data-' # For flags like: \"--data-ascii\", \"--data-binary\", \"--data-raw\", \"--data-urlencode\"\n        - CommandLine|re: '\\s-[FTd]\\s' # We use regex to ensure a case sensitive argument detection\n    filter_optional_localhost:\n        CommandLine|contains:\n            - '://localhost'\n            - '://127.0.0.1'\n    condition: all of selection_* and not 1 of filter_optional_*\nfalsepositives:\n    - Scripts created by developers and admins\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1567","id":"T1567","name":"Exfiltration Over Web Service","page":"techniques/enterprise/T1567/"}],"data_path":"data/detection-rules/00b90cc1-17ec-402c-96ad-3a8117d7a582.json","kind":"sigma"}