Windows: Curl.exe Insecure Proxy/DOH Transfer Flags
Flags curl.exe with --proxy-insecure and/or --doh-insecure during Windows process execution.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-27
- Updated
- 2026-07-31
What it detects
This rule identifies process executions where curl.exe is run with insecure settings for proxy or DNS-over-HTTPS (DOH) transfers. Attackers may use these flags to bypass standard certificate and proxy validation, weakening transport security and enabling interception or redirection. It relies on Windows process creation telemetry, matching curl.exe by image/original filename and looking for the specific command-line options associated with insecure proxy or DOH behavior.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-insecure-proxy-doh-transfer-using-curl-exe-flags-proxy-insecure-doh-inse-2c1486f5
title: "Windows: Curl.exe Insecure Proxy/DOH Transfer Flags"
id: 6dca638a-249c-4cac-8888-1508df0774eb
status: test
description: This rule identifies process executions where curl.exe is run with insecure settings for proxy or DNS-over-HTTPS (DOH) transfers. Attackers may use these flags to bypass standard certificate and proxy validation, weakening transport security and enabling interception or redirection. It relies on Windows process creation telemetry, matching curl.exe by image/original filename and looking for the specific command-line options associated with insecure proxy or DOH behavior.
references:
- https://curl.se/docs/manpage.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_cli:
CommandLine|contains:
- --doh-insecure
- --proxy-insecure
condition: all of selection_*
falsepositives:
- Access to badly maintained internal or development systems
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh/info.yml
license: DRL-1.1
related:
- id: 2c1486f5-02e8-4f86-9099-b97f2da4ed77
type: derived