huntrule

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Alerts on Windows process launches whose PE metadata matches curl.exe even when the executable image is renamed.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-09-11
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions where PE metadata indicates the OriginalFileName is "curl.exe" and the process image contains "\curl", suggesting an impersonation or renamed binary. Attackers may rename legitimate utilities like curl.exe to blend into normal tooling while still leveraging its functionality. The detection relies on process creation telemetry that includes PE metadata fields (OriginalFileName and Description) and the created process image path.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange
Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Windows: Detect ftp.exe Executed With -s or /s for Script-Based Command Execution
Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata
Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'
Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled
Suspicious OneNote Spawning Command or Script Interpreter via Spear-Phishing (via process_creation)
Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)
Suspicious VMware Guest Operation Output Staging in vmware-system Temp Directory (via file_event)
Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Pivot detection · T1059 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.