Windows curl.exe File Download From IP URL via Command-Line

title: Windows curl.exe File Download From IP URL via Command-Line
id: aeeb6011-df72-4949-b566-2d2a123c62be
related:
  - id: 5cb299fc-5fb1-4d07-b989-0644c68b6043
    type: similar
  - id: 9cc85849-3b02-4cb5-b371-3a1ff54f2218
    type: derived
status: test
description: This rule identifies Windows process executions where curl.exe is invoked with a URL that contains an IP address (matching an http(s) scheme pattern). It further requires the command line to include HTTP indicators and file output/remote-name style flags such as --output, --remote-name, or -O, suggesting an attempt to download content. Detection relies on process creation telemetry including Image/OriginalFileName and full CommandLine arguments.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-18
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_ip:
    CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  selection_http:
    CommandLine|contains: http
  selection_flag:
    CommandLine|contains:
      - " -O"
      - --remote-name
      - --output
  filter_main_ext:
    CommandLine|endswith:
      - .bat
      - .bat"
      - .dat
      - .dat"
      - .dll
      - .dll"
      - .exe
      - .exe"
      - .gif
      - .gif"
      - .hta
      - .hta"
      - .jpeg
      - .jpeg"
      - .log
      - .log"
      - .msi
      - .msi"
      - .png
      - .png"
      - .ps1
      - .ps1"
      - .psm1
      - .psm1"
      - .vbe
      - .vbe"
      - .vbs
      - .vbs"
      - .bat'
      - .dat'
      - .dll'
      - .exe'
      - .gif'
      - .hta'
      - .jpeg'
      - .log'
      - .msi'
      - .png'
      - .ps1'
      - .psm1'
      - .vbe'
      - .vbs'
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec/info.yml
license: DRL-1.1