Windows curl.exe Execution Using Custom User-Agent Option

title: Windows curl.exe Execution Using Custom User-Agent Option
id: 661e252e-2445-4aad-bb9f-073ef6015e84
status: test
description: This rule identifies executions of curl.exe where the command line includes user-agent customization via the -A or --user-agent options. Attackers may use curl to blend in with normal web traffic or to manipulate how remote services respond based on the client user agent. The detection relies on Windows process creation telemetry, specifically the executed image path and the raw command line contents.
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#atomic-test-2---malicious-user-agents---cmd
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_useragent.yml
author: frack113, Huntrule Team
date: 2022-01-23
modified: 2023-02-21
tags:
  - attack.command-and-control
  - attack.t1071.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_curl:
    - Image|endswith: \curl.exe
    - Product: The curl executable
  selection_opt:
    CommandLine|contains:
      - " -A "
      - " --user-agent "
  condition: all of selection_*
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
level: medium
license: DRL-1.1
related:
  - id: 3286d37a-00fd-41c2-a624-a672dcd34e60
    type: derived