Linux curl Execution Observed via Process Start

Flags Linux process starts for the curl binary, indicating potential remote file download or web requests.

FreeUnreviewedSigmalowv1

linux-curl-execution-observed-via-process-start-ea34fb97

title: Linux curl Execution Observed via Process Start
id: 7e6e4f5a-33d9-478c-b027-6f7c704e4c5b
status: test
description: This rule matches process creation events where the executable path ends with '/curl' on Linux. Attackers commonly use curl to retrieve remote resources for payload delivery or to perform simple HTTP requests. The detection relies on process creation telemetry that includes the launched process image or executable path.
references:
  - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_curl_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /curl
  condition: selection
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
level: low
license: DRL-1.1
related:
  - id: ea34fb97-e2c4-4afb-810f-785e4459b194
    type: derived

What it detects

This rule matches process creation events where the executable path ends with '/curl' on Linux. Attackers commonly use curl to retrieve remote resources for payload delivery or to perform simple HTTP requests. The detection relies on process creation telemetry that includes the launched process image or executable path.

Known false positives

Scripts created by developers and admins
Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.