Windows: Insecure proxy/DoH transfer using curl.exe flags (--proxy-insecure, --doh-insecure)

Flags curl.exe with --proxy-insecure and/or --doh-insecure during Windows process execution.

FreeUnreviewedSigmamediumv1

windows-insecure-proxy-doh-transfer-using-curl-exe-flags-proxy-insecure-doh-inse-2c1486f5

title: "Windows: Insecure proxy/DoH transfer using curl.exe flags (--proxy-insecure, --doh-insecure)"
id: 6dca638a-249c-4cac-8888-1508df0774eb
status: test
description: This rule identifies Windows process creation where curl.exe is executed with insecure proxy and/or insecure DNS-over-HTTPS (DoH) options. Attackers may use these flags to reduce TLS verification for proxy and DoH connections, potentially enabling interception or spoofing of the destination content. The detection relies on process creation telemetry, matching curl.exe by filename and the presence of the specific command-line flags.
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_cli:
    CommandLine|contains:
      - --doh-insecure
      - --proxy-insecure
  condition: all of selection_*
falsepositives:
  - Access to badly maintained internal or development systems
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh/info.yml
license: DRL-1.1
related:
  - id: 2c1486f5-02e8-4f86-9099-b97f2da4ed77
    type: derived

What it detects

This rule identifies Windows process creation where curl.exe is executed with insecure proxy and/or insecure DNS-over-HTTPS (DoH) options. Attackers may use these flags to reduce TLS verification for proxy and DoH connections, potentially enabling interception or spoofing of the destination content. The detection relies on process creation telemetry, matching curl.exe by filename and the presence of the specific command-line flags.

Known false positives

Access to badly maintained internal or development systems

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.