Windows Process Execution: curl.exe Saving Cookies via -c / --cookie-jar
Flags curl.exe commands that save cookie jar data using -c/--cookie-jar on Windows process creation events.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-27
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation events where curl.exe is executed with flags consistent with saving cookies to disk (using -c and/or --cookie-jar). Attackers may do this to capture or persist session-related data for later reuse or hijacking attempts. Detection relies on process creation telemetry, specifically the executable name/path and command-line arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-curl-exe-cookie-jar-saving-via-c-cookie-jar-5a6e1e16
title: "Windows Process Execution: curl.exe Saving Cookies via -c / --cookie-jar"
id: 70515e0c-1c99-4a3a-93a5-37262b52d08e
status: test
description: This rule identifies Windows process creation events where curl.exe is executed with flags consistent with saving cookies to disk (using -c and/or --cookie-jar). Attackers may do this to capture or persist session-related data for later reuse or hijacking attempts. Detection relies on process creation telemetry, specifically the executable name/path and command-line arguments.
references:
- https://curl.se/docs/manpage.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_cli:
- CommandLine|re: \s-c\s
- CommandLine|contains: --cookie-jar
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
license: DRL-1.1
related:
- id: 5a6e1e16-07de-48d8-8aae-faa766c05e88
type: derived