Windows Process Execution: curl.exe Downloading Files From an IP URL
Flags curl.exe commands that download via an IP-based URL using output/remote-name flags.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-18
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation events where curl.exe is executed with a URL that directly contains an IPv4 address. It looks for command-line patterns consistent with HTTP/URL usage and file output flags (such as --output or -O). Excluding common executable and script/media extensions helps reduce overlap with related detections. Telemetry relied upon is Windows process creation command-line data, including Image/OriginalFileName and CommandLine content.
Reporting behind it
- labs.withsecure.comhttps://labs.withsecure.com/publications/fin7-target-veeam-servers
- github.comhttps://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- github.comhttps://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-curl-exe-file-download-from-ip-url-via-command-line-9cc85849
title: "Windows Process Execution: curl.exe Downloading Files From an IP URL"
id: aeeb6011-df72-4949-b566-2d2a123c62be
related:
- id: 5cb299fc-5fb1-4d07-b989-0644c68b6043
type: similar
- id: 9cc85849-3b02-4cb5-b371-3a1ff54f2218
type: derived
status: test
description: This rule identifies Windows process creation events where curl.exe is executed with a URL that directly contains an IPv4 address. It looks for command-line patterns consistent with HTTP/URL usage and file output flags (such as --output or -O). Excluding common executable and script/media extensions helps reduce overlap with related detections. Telemetry relied upon is Windows process creation command-line data, including Image/OriginalFileName and CommandLine content.
references:
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-18
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_ip:
CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
selection_http:
CommandLine|contains: http
selection_flag:
CommandLine|contains:
- " -O"
- --remote-name
- --output
filter_main_ext:
CommandLine|endswith:
- .bat
- .bat"
- .dat
- .dat"
- .dll
- .dll"
- .exe
- .exe"
- .gif
- .gif"
- .hta
- .hta"
- .jpeg
- .jpeg"
- .log
- .log"
- .msi
- .msi"
- .png
- .png"
- .ps1
- .ps1"
- .psm1
- .psm1"
- .vbe
- .vbe"
- .vbs
- .vbs"
- .bat'
- .dat'
- .dll'
- .exe'
- .gif'
- .hta'
- .jpeg'
- .log'
- .msi'
- .png'
- .ps1'
- .psm1'
- .vbe'
- .vbs'
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec/info.yml
license: DRL-1.1