Windows Process Execution: curl.exe with Custom User-Agent Header
Flags Windows executions of curl.exe that include a User-Agent header in the command line.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-27
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation events where curl.exe is executed with a header that includes a User-Agent value (e.g., via command-line header flags). Attackers can use curl to blend into normal network tooling while controlling the HTTP User-Agent used for fetching or sending data to external endpoints. The detection relies on telemetry from Windows process creation, matching curl.exe by executable name/original file name and then verifying the presence of header flags and a 'User-Agent:' string in the command line.
Reporting behind it
- labs.withsecure.comhttps://labs.withsecure.com/publications/fin7-target-veeam-servers
- github.comhttps://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Execution: curl.exe with Custom User-Agent Header"
id: 9f35d170-e813-4058-b62e-ae535d4f061b
status: test
description: This rule identifies Windows process creation events where curl.exe is executed with a header that includes a User-Agent value (e.g., via command-line header flags). Attackers can use curl to blend into normal network tooling while controlling the HTTP User-Agent used for fetching or sending data to external endpoints. The detection relies on telemetry from Windows process creation, matching curl.exe by executable name/original file name and then verifying the presence of header flags and a 'User-Agent:' string in the command line.
references:
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
modified: 2025-12-11
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_header_flag_1:
CommandLine|re: \s-H\s
selection_header_flag_2:
CommandLine|contains: --header
selection_user_agent:
CommandLine|contains: "User-Agent:"
condition: selection_img and 1 of selection_header_* and selection_user_agent
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent/info.yml
license: DRL-1.1
related:
- id: 85de1f22-d189-44e4-8239-dc276b45379b
type: derived