Windows Process Creation: curl.exe Cookie Jar Saving via -c/--cookie-jar

Flags curl.exe commands that save cookie jar data using -c/--cookie-jar on Windows process creation events.

FreeUnreviewedSigmamediumv1

windows-process-creation-curl-exe-cookie-jar-saving-via-c-cookie-jar-5a6e1e16

title: "Windows Process Creation: curl.exe Cookie Jar Saving via -c/--cookie-jar"
id: 70515e0c-1c99-4a3a-93a5-37262b52d08e
status: test
description: This rule identifies Windows executions of curl.exe where the command line includes cookie jar saving behavior (using -c and/or --cookie-jar). Attackers may use this to persist or capture session cookies as part of session hijacking workflows. The detection relies on process creation telemetry, matching the image path/filename and command-line arguments on the host.
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_cli:
    - CommandLine|re: \s-c\s
    - CommandLine|contains: --cookie-jar
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
license: DRL-1.1
related:
  - id: 5a6e1e16-07de-48d8-8aae-faa766c05e88
    type: derived

What it detects

This rule identifies Windows executions of curl.exe where the command line includes cookie jar saving behavior (using -c and/or --cookie-jar). Attackers may use this to persist or capture session cookies as part of session hijacking workflows. The detection relies on process creation telemetry, matching the image path/filename and command-line arguments on the host.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.