Windows Process Execution of curl.exe with --insecure Flag
Flags curl.exe launched with --insecure/-k to disable TLS certificate verification.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-30
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events where curl.exe is executed with the --insecure (or -k) option. Attackers may use this to bypass TLS certificate validation when making outbound transfers, weakening transport security and facilitating interception or misuse of untrusted endpoints. The detection relies on process creation telemetry, matching the executable identity as curl.exe and examining the command-line arguments for the insecure flags.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-detect-curl-exe-executed-with-insecure-insecure-tls-transfer-cb9cc1d1
title: Windows Process Execution of curl.exe with --insecure Flag
id: 86c4f444-cabd-4d00-99b3-b36705a84404
status: test
description: This rule flags Windows process creation events where curl.exe is executed with the --insecure (or -k) option. Attackers may use this to bypass TLS certificate validation when making outbound transfers, weakening transport security and facilitating interception or misuse of untrusted endpoints. The detection relies on process creation telemetry, matching the executable identity as curl.exe and examining the command-line arguments for the insecure flags.
references:
- https://curl.se/docs/manpage.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_insecure_connection.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-30
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_cli:
- CommandLine|re: \s-k\s
- CommandLine|contains: --insecure
condition: all of selection_*
falsepositives:
- Access to badly maintained internal or development systems
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/info.yml
license: DRL-1.1
related:
- id: cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec
type: derived