Windows: Detect curl.exe Executed with --insecure (Insecure TLS Transfer)

Flags curl.exe launched with --insecure/-k to disable TLS certificate verification.

FreeUnreviewedSigmamediumv1

windows-detect-curl-exe-executed-with-insecure-insecure-tls-transfer-cb9cc1d1

title: "Windows: Detect curl.exe Executed with --insecure (Insecure TLS Transfer)"
id: 86c4f444-cabd-4d00-99b3-b36705a84404
status: test
description: This rule flags Windows process creation events where curl.exe is executed with the --insecure option (equivalent to -k), which disables certificate verification for TLS connections. Attackers can use this to bypass trust checks when connecting to improperly configured or untrusted endpoints. The detection relies on process creation telemetry including the executable identity (Image/OriginalFileName) and the command-line arguments containing --insecure and matching -k.
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_insecure_connection.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-30
tags:
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_cli:
    - CommandLine|re: \s-k\s
    - CommandLine|contains: --insecure
  condition: all of selection_*
falsepositives:
  - Access to badly maintained internal or development systems
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/info.yml
license: DRL-1.1
related:
  - id: cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec
    type: derived

What it detects

This rule flags Windows process creation events where curl.exe is executed with the --insecure option (equivalent to -k), which disables certificate verification for TLS connections. Attackers can use this to bypass trust checks when connecting to improperly configured or untrusted endpoints. The detection relies on process creation telemetry including the executable identity (Image/OriginalFileName) and the command-line arguments containing --insecure and matching -k.

Known false positives

Access to badly maintained internal or development systems

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.