Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

title: "Windows Process Creation: Execution of Renamed curl.exe via PE Metadata"
id: 3cbea56f-af10-4068-9e94-d128a9a59afd
status: test
description: This rule flags process executions where PE metadata indicates the OriginalFileName is "curl.exe" and the process image contains "\curl", suggesting an impersonation or renamed binary. Attackers may rename legitimate utilities like curl.exe to blend into normal tooling while still leveraging its functionality. The detection relies on process creation telemetry that includes PE metadata fields (OriginalFileName and Description) and the created process image path.
references:
  - https://twitter.com/Kostastsale/status/1700965142828290260
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_curl.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-09-11
modified: 2023-10-12
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: curl.exe
    - Description: The curl executable
  filter_main_img:
    Image|contains: \curl
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_curl/info.yml
license: DRL-1.1
related:
  - id: 7530cd3d-7671-43e3-b209-976966f6ea48
    type: derived