{"id":"e218595b-bbe7-4ee5-8a96-f32a24ad3468","title":"Suspicious Curl.EXE Download","description":"Detects a suspicious curl process start on Windows and outputs the requested document to a local file","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-07-03","modified":"2023-02-21","tags":["attack.command-and-control","attack.t1105"],"technique_ids":["T1105"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/max_mal_/status/1542461200797163522","https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464","https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt","https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file"],"source_path":"rules/windows/process_creation/proc_creation_win_curl_susp_download.yml","source_sha256":"6488ac193d6c1369f4efc7de10113e6b272db296abe3bae0dc5bd5285cd0eed8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_curl_susp_download.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Curl.EXE Download\nid: e218595b-bbe7-4ee5-8a96-f32a24ad3468\nrelated:\n    - id: bbeaed61-1990-4773-bf57-b81dbad7db2d # Basic curl execution\n      type: derived\n    - id: 9a517fca-4ba3-4629-9278-a68694697b81 # Curl download\n      type: similar\nstatus: test\ndescription: Detects a suspicious curl process start on Windows and outputs the requested document to a local file\nreferences:\n    - https://twitter.com/max_mal_/status/1542461200797163522\n    - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464\n    - https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt\n    - https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/\n    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2020-07-03\nmodified: 2023-02-21\ntags:\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_curl:\n        - Image|endswith: '\\curl.exe'\n        - Product: 'The curl executable'\n    selection_susp_locations:\n        CommandLine|contains:\n            - '%AppData%'\n            - '%Public%'\n            - '%Temp%'\n            - '%tmp%'\n            - '\\AppData\\'\n            - '\\Desktop\\'\n            - '\\Temp\\'\n            - '\\Users\\Public\\'\n            - 'C:\\PerfLogs\\'\n            - 'C:\\ProgramData\\'\n            - 'C:\\Windows\\Temp\\'\n    selection_susp_extensions:\n        CommandLine|endswith:\n            - '.dll'\n            - '.gif'\n            - '.jpeg'\n            - '.jpg'\n            - '.png'\n            - '.temp'\n            - '.tmp'\n            - '.txt'\n            - '.vbe'\n            - '.vbs'\n    filter_optional_git_windows:\n        # Example FP\n        #   CommandLine: \"C:\\Program Files\\Git\\mingw64\\bin\\curl.exe\" --silent --show-error --output C:/Users/test/AppData/Local/Temp/gfw-httpget-jVOEoxbS.txt --write-out %{http_code} https://gitforwindows.org/latest-tag.txt\n        ParentImage: 'C:\\Program Files\\Git\\usr\\bin\\sh.exe'\n        Image: 'C:\\Program Files\\Git\\mingw64\\bin\\curl.exe'\n        CommandLine|contains|all:\n            - '--silent --show-error --output '\n            - 'gfw-httpget-'\n            - 'AppData'\n    condition: selection_curl and 1 of selection_susp_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Curl Download File\n      technique: T1105\n      atomic_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"}],"data_path":"data/detection-rules/e218595b-bbe7-4ee5-8a96-f32a24ad3468.json","kind":"sigma"}