Suspicious curl User-Agent changes on Linux via process creation

title: Suspicious curl User-Agent changes on Linux via process creation
id: 86d805f4-cbe6-4de7-b1eb-c9d257de3c61
related:
  - id: 3286d37a-00fd-41c2-a624-a672dcd34e60
    type: derived
  - id: b86d356d-6093-443d-971c-9b07db583c68
    type: derived
status: test
description: Identifies Linux process starts where the executable path ends with '/curl' and the command line includes user-agent modification flags (' -A ' or ' --user-agent '). Attackers may adjust User-Agent strings to blend in with normal client traffic or to evade simple detection rules during command-and-control activity. The rule relies on Linux process creation telemetry with command line arguments.
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /curl
    CommandLine|contains:
      - " -A "
      - " --user-agent "
  condition: selection
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
level: medium
license: DRL-1.1