Windows curl.exe Execution Using TOR SOCKS Proxy (SOCKS and .onion in Command Line)

title: Windows curl.exe Execution Using TOR SOCKS Proxy (SOCKS and .onion in Command Line)
id: 173dfd3a-a09a-4562-9e3c-4e5917dfeae6
status: experimental
description: This rule flags process executions where curl.exe is launched with command-line arguments indicating use of a SOCKS proxy for Tor (SOCKS URI schemes such as socks5h://, socks5://, or socks4a://) and also references a .onion destination. Such behavior matters because attackers can route outbound communications through anonymity networks for command-and-control or data exfiltration. The detection relies on Windows process creation telemetry, matching both the executable path ending with curl.exe and specific substrings in the command line.
references:
  - https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/proc_creation_win_malware_kalambur_curl_socks_tor.yml
author: Arda Buyukkaya (EclecticIQ), Huntrule Team
date: 2025-02-11
tags:
  - attack.execution
  - attack.command-and-control
  - attack.t1090
  - attack.t1573
  - attack.t1071.001
  - attack.t1059.001
  - attack.s0183
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \curl.exe
  selection_socks:
    CommandLine|contains:
      - socks5h://
      - socks5://
      - socks4a://
  selection_onion:
    CommandLine|contains: .onion
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e99375eb-3ee0-407a-9f90-79569cc6a01c
    type: derived