Windows curl.exe Execution Using Custom User-Agent Flags
Flags Windows process launches of curl.exe with -A/--user-agent parameters to set a custom user agent.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-23
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches process creation events where curl.exe is executed with command-line arguments specifying a custom user agent (e.g., -A or --user-agent). Attackers can use customized user-agent strings to blend in with legitimate traffic patterns during command-and-control or data retrieval. It relies on Windows process creation telemetry and inspects the command line for the user-agent option tokens.
Reporting behind it
- curl.sehttps://curl.se/docs/manpage.html
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#atomic-test-2---malicious-user-agents---cmd
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_useragent.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows curl.exe Execution Using Custom User-Agent Flags
id: 661e252e-2445-4aad-bb9f-073ef6015e84
status: test
description: This rule matches process creation events where curl.exe is executed with command-line arguments specifying a custom user agent (e.g., -A or --user-agent). Attackers can use customized user-agent strings to blend in with legitimate traffic patterns during command-and-control or data retrieval. It relies on Windows process creation telemetry and inspects the command line for the user-agent option tokens.
references:
- https://curl.se/docs/manpage.html
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#atomic-test-2---malicious-user-agents---cmd
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_useragent.yml
author: frack113, Huntrule Team
date: 2022-01-23
modified: 2023-02-21
tags:
- attack.command-and-control
- attack.t1071.001
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_curl:
- Image|endswith: \curl.exe
- Product: The curl executable
selection_opt:
CommandLine|contains:
- " -A "
- " --user-agent "
condition: all of selection_*
falsepositives:
- Scripts created by developers and admins
- Administrative activity
level: medium
license: DRL-1.1
related:
- id: 3286d37a-00fd-41c2-a624-a672dcd34e60
type: derived