Windows curl.exe Web Requests With Custom User-Agent Headers

title: Windows curl.exe Web Requests With Custom User-Agent Headers
id: 9f35d170-e813-4058-b62e-ae535d4f061b
status: test
description: This rule matches process creation events where curl.exe is executed with a User-Agent header specified via command-line flags. Attackers can use customized User-Agent values to influence how a server handles the request, which can support data download or exfiltration workflows. The detection relies on Windows process command-line telemetry, checking for curl.exe execution along with header-related arguments and the presence of "User-Agent:".
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
modified: 2025-12-11
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_header_flag_1:
    CommandLine|re: \s-H\s
  selection_header_flag_2:
    CommandLine|contains: --header
  selection_user_agent:
    CommandLine|contains: "User-Agent:"
  condition: selection_img and 1 of selection_header_* and selection_user_agent
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent/info.yml
license: DRL-1.1
related:
  - id: 85de1f22-d189-44e4-8239-dc276b45379b
    type: derived