Windows curl.exe Download to Local File with Suspicious Paths and Extensions

title: Windows curl.exe Download to Local File with Suspicious Paths and Extensions
id: 0a71b113-2ec9-4048-8d53-1c9bf6bf7132
related:
  - id: bbeaed61-1990-4773-bf57-b81dbad7db2d
    type: derived
  - id: 9a517fca-4ba3-4629-9278-a68694697b81
    type: similar
  - id: e218595b-bbe7-4ee5-8a96-f32a24ad3468
    type: derived
status: test
description: This rule identifies process creation events where the executable is curl.exe and the command line indicates the output file is written to commonly abused user and system directories. It further matches potentially suspicious file extensions associated with script, executable, or document artifacts. This matters because attackers frequently use curl for command-and-control related downloading and staging, and local file writes are a key artifact in that activity. The detection relies on Windows process creation telemetry, including Image and CommandLine fields, to correlate curl execution with specific output locations and extensions.
references:
  - https://twitter.com/max_mal_/status/1542461200797163522
  - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464
  - https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt
  - https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_susp_download.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-07-03
modified: 2023-02-21
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_curl:
    - Image|endswith: \curl.exe
    - Product: The curl executable
  selection_susp_locations:
    CommandLine|contains:
      - "%AppData%"
      - "%Public%"
      - "%Temp%"
      - "%tmp%"
      - \AppData\
      - \Desktop\
      - \Temp\
      - \Users\Public\
      - C:\PerfLogs\
      - C:\ProgramData\
      - C:\Windows\Temp\
  selection_susp_extensions:
    CommandLine|endswith:
      - .dll
      - .gif
      - .jpeg
      - .jpg
      - .png
      - .temp
      - .tmp
      - .txt
      - .vbe
      - .vbs
  filter_optional_git_windows:
    ParentImage: C:\Program Files\Git\usr\bin\sh.exe
    Image: C:\Program Files\Git\mingw64\bin\curl.exe
    CommandLine|contains|all:
      - "--silent --show-error --output "
      - gfw-httpget-
      - AppData
  condition: selection_curl and 1 of selection_susp_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/info.yml
simulation:
  - type: atomic-red-team
    name: Curl Download File
    technique: T1105
    atomic_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a
license: DRL-1.1