Windows: curl Command-Line Download Followed by Execution via '&' and Output Redirection

title: "Windows: curl Command-Line Download Followed by Execution via '&' and Output Redirection"
id: bfd33ec1-f188-44f6-b5e9-b9b5d305d2d7
status: test
description: This rule matches Windows process creation events where the command line uses curl to fetch content over HTTP, saves output with the -o option, and then chains execution using the '&' operator. Chaining download and execution is a common attacker pattern to move from remote retrieval to immediate payload execution without additional tooling. It relies on process creation telemetry containing the full CommandLine string.
references:
  - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml
author: Sreeman, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-01-13
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1218
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|windash: " -c "
    CommandLine|contains|all:
      - "curl "
      - http
      - -o
      - "&"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 21dd6d38-2b18-4453-9404-a0fe4a0cc288
    type: derived