Windows curl.exe Process Execution for Remote File Transfer

Alerts on execution of curl.exe on Windows, which may indicate remote downloads or web requests.

FreeUnreviewedSigmalowv1

windows-curl-exe-process-execution-for-remote-file-transfer-bbeaed61

title: Windows curl.exe Process Execution for Remote File Transfer
id: fb3d7012-b801-4224-af08-380766334a10
related:
  - id: e218595b-bbe7-4ee5-8a96-f32a24ad3468
    type: derived
  - id: bbeaed61-1990-4773-bf57-b81dbad7db2d
    type: derived
status: test
description: This rule triggers when a Windows process is created with an image ending in \curl.exe (the curl executable). Attackers commonly use curl to download remote payloads or make direct HTTP(S) requests during command-and-control or initial staging. It relies on Windows process creation telemetry that records the executable path/name for newly started processes.
references:
  - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2023-02-21
tags:
  - attack.command-and-control
  - attack.t1105
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \curl.exe
    - Product: The curl executable
  condition: selection
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
level: low
license: DRL-1.1

What it detects

This rule triggers when a Windows process is created with an image ending in \curl.exe (the curl executable). Attackers commonly use curl to download remote payloads or make direct HTTP(S) requests during command-and-control or initial staging. It relies on Windows process creation telemetry that records the executable path/name for newly started processes.

Known false positives

Scripts created by developers and admins
Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.