Detection rules › Sigma

Curl Download And Execute Combination

Severity
high
Author
Sreeman, Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218 System Binary Proxy Execution
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

CommandLine|contains: ' -c '
CommandLine|contains: '&'
CommandLine|contains: -o
CommandLine|contains: 'curl '
CommandLine|contains: http

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -c corpus 11 (sigma 11)
  • &
  • -o corpus 2 (sigma 2)
  • curl corpus 8 (sigma 8)
  • http corpus 31 (sigma 31)