Suspicious Curl Change User Agents - Linux (via process_creation)

title: Suspicious Curl Change User Agents - Linux (via process_creation)
id: 71fdacd8-2323-52c3-b2f1-74a657065cb9
status: stable
description: This rule detects an anomalous curl process start on linux with set useragent options
references:
    - https://attack.mitre.org/techniques/T1071/001/
    - https://curl.se/docs/manpage.html
author: Huntrule Team
date: 2026-06-13
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/curl'
        CommandLine|contains:
            - ' -A '
            - ' --user-agent '
    condition: selection
falsepositives:
    - Unknown
level: medium