Linux Suspicious curl Start with User-Agent Modification Flags

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags Linux process creations where the executable path ends with /curl and the command line includes curl user-agent modification options (-A or --user-agent). Attackers commonly alter the User-Agent string to blend in with legitimate traffic or to influence downstream responses during command-and-control activity. The detection relies on process creation telemetry, specifically the process image path and command-line arguments.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Linux Suspicious curl Start with User-Agent Modification Flags

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-curl-user-agent-changes-on-linux-via-process-creation-b86d356d

title: Linux Suspicious curl Start with User-Agent Modification Flags
id: 86d805f4-cbe6-4de7-b1eb-c9d257de3c61
related:
  - id: 3286d37a-00fd-41c2-a624-a672dcd34e60
    type: derived
  - id: b86d356d-6093-443d-971c-9b07db583c68
    type: derived
status: test
description: This rule flags Linux process creations where the executable path ends with /curl and the command line includes curl user-agent modification options (-A or --user-agent). Attackers commonly alter the User-Agent string to blend in with legitimate traffic or to influence downstream responses during command-and-control activity. The detection relies on process creation telemetry, specifically the process image path and command-line arguments.
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /curl
    CommandLine|contains:
      - " -A "
      - " --user-agent "
  condition: selection
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL