Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Alerts on Windows process launches whose PE metadata matches curl.exe even when the executable image is renamed.
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-11
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where PE metadata indicates the OriginalFileName is "curl.exe" and the process image contains "\curl", suggesting an impersonation or renamed binary. Attackers may rename legitimate utilities like curl.exe to blend into normal tooling while still leveraging its functionality. The detection relies on process creation telemetry that includes PE metadata fields (OriginalFileName and Description) and the created process image path.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Execution of Renamed curl.exe via PE Metadata"
id: 3cbea56f-af10-4068-9e94-d128a9a59afd
status: test
description: This rule flags process executions where PE metadata indicates the OriginalFileName is "curl.exe" and the process image contains "\curl", suggesting an impersonation or renamed binary. Attackers may rename legitimate utilities like curl.exe to blend into normal tooling while still leveraging its functionality. The detection relies on process creation telemetry that includes PE metadata fields (OriginalFileName and Description) and the created process image path.
references:
- https://twitter.com/Kostastsale/status/1700965142828290260
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_curl.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-09-11
modified: 2023-10-12
tags:
- attack.execution
- attack.stealth
- attack.t1059
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection:
- OriginalFileName: curl.exe
- Description: The curl executable
filter_main_img:
Image|contains: \curl
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_curl/info.yml
license: DRL-1.1
related:
- id: 7530cd3d-7671-43e3-b209-976966f6ea48
type: derived