Windows Process Creation: curl.exe Reading Local Files via file:/// URI

title: "Windows Process Creation: curl.exe Reading Local Files via file:/// URI"
id: c62d6255-6332-4f93-b709-d301c8508fcd
status: test
description: This rule identifies Windows executions of curl.exe where the command line includes the file:/// protocol handler, indicating an attempt to read local files. Attackers commonly use this pattern to access sensitive local data while blending in with legitimate tooling. The detection relies on process creation telemetry, specifically the executable image and the presence of file:/// in the command line.
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_local_file_read.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_cli:
    CommandLine|contains: file:///
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/info.yml
license: DRL-1.1
related:
  - id: aa6f6ea6-0676-40dd-b510-6e46f02d8867
    type: derived