Windows curl.exe Downloads File From Direct IP via HTTP/S With Suspicious Extension

title: Windows curl.exe Downloads File From Direct IP via HTTP/S With Suspicious Extension
id: c4bd4581-4b38-47ec-b6e2-6e56cc7380c5
status: test
description: This rule flags Windows command executions where curl.exe is used to fetch content from a literal IP address over HTTP/S. It focuses on suspicious download behavior by requiring HTTP in the command line, an explicit output/remote-name style flag, and a downloaded URL ending with potentially executable or script-related extensions. The detection relies on process creation telemetry, specifically the image name, full command line, and the presence of IP-address and file extension patterns in that command line.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_ip:
    CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  selection_http:
    CommandLine|contains: http
  selection_flag:
    CommandLine|contains:
      - " -O"
      - --remote-name
      - --output
  selection_ext:
    CommandLine|endswith:
      - .bat
      - .bat"
      - .dat
      - .dat"
      - .dll
      - .dll"
      - .exe
      - .exe"
      - .gif
      - .gif"
      - .hta
      - .hta"
      - .jpeg
      - .jpeg"
      - .log
      - .log"
      - .msi
      - .msi"
      - .png
      - .png"
      - .ps1
      - .ps1"
      - .psm1
      - .psm1"
      - .vbe
      - .vbe"
      - .vbs
      - .vbs"
      - .bat'
      - .dat'
      - .dll'
      - .exe'
      - .gif'
      - .hta'
      - .jpeg'
      - .log'
      - .msi'
      - .png'
      - .ps1'
      - .psm1'
      - .vbe'
      - .vbs'
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions/info.yml
license: DRL-1.1
related:
  - id: 5cb299fc-5fb1-4d07-b989-0644c68b6043
    type: derived