Windows curl.exe File Download via -O, --remote-name, or --output

title: Windows curl.exe File Download via -O, --remote-name, or --output
id: c66b93b7-7381-4f4b-a5c8-a6c2e6773cff
related:
  - id: bbeaed61-1990-4773-bf57-b81dbad7db2d
    type: derived
  - id: e218595b-bbe7-4ee5-8a96-f32a24ad3468
    type: derived
  - id: 9a517fca-4ba3-4629-9278-a68694697b81
    type: derived
status: test
description: This rule identifies Windows process executions where curl.exe is used to download files using output-related flags such as -O, --remote-name, or --output. This behavior is a common step in attacker tooling for retrieving payloads or staging files for later execution. It relies on Windows process creation telemetry including the process image path and command-line arguments.
references:
  - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_download.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2023-02-21
tags:
  - attack.command-and-control
  - attack.t1105
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - Product: The curl executable
  selection_remote:
    CommandLine|contains:
      - " -O"
      - --remote-name
      - --output
  condition: all of selection_*
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
  - The "\Git\usr\bin\sh.exe" process uses the "--output" flag to download a specific file in the temp directory with the pattern "gfw-httpget-xxxxxxxx.txt "
level: medium
license: DRL-1.1