Query: Sigma rule for Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Matching passage: Sigma rule: Detects a suspicious curl process start on Windows and outputs the requested document to a local file. Logsource: windows / process_creation. Rule: title: Suspicious Curl.EXE Download id: e218595b-bbe7-4ee5-8a96-f32a24ad3468 related: - id: bbeaed61-1990-4773-bf57-b81dbad7db2d type: derived - id: 9a517fca-4ba3-4629-9278-a68694697b81 type: similar status: test description: Detects a suspicious curl process start on Windows and outputs the requested document to a local file references: - https://twitter.com/max_mal_/status/1542461200797163522 - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464 - https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt - https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/ - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-07-03 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_curl: - Image|endswith: \curl.exe - Product: The curl executable selection_susp_locations: CommandLine|contains: - '%AppData%' - '%Public%' - '%Temp%' - '%tmp%' - \AppData\ - \Desktop\ - \Temp\ - \Users\Public\ - C:\PerfLogs\ - C:\ProgramData\ - C:\Windows\Temp\ selection_susp_extensions: CommandLine|endswith: - .dll - .gif - .jpeg - .jpg - .png - .temp - .tmp - .txt - .vbe - .vbs filter_optional_git_windows: ParentImage: C:\Program Files\Git\usr\bin\sh.exe Image: C:\Program Files\Git\mingw64\bin\curl.exe CommandLine|contains|all: - '--silent --show-error --output ' - gfw-httpget- - AppData condition: selection_curl and 1 of selection_susp_* and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/info.yml simulation: - type: atomic-red-team name: Curl Download File technique: T1105 atomic_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a
Near-miss passage: Sigma rule: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.. Logsource: windows / process_creation. Rule: title: Cloudflared Tunnel Connections Cleanup id: 7050bba1-1aed-454e-8f73-3f46f09ce56a status: test description: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections. references: - https://github.com/cloudflare/cloudflared - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-17 modified: 2023-12-21 tags: - attack.command-and-control - attack.t1102 - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' tunnel ' - 'cleanup ' CommandLine|contains: - '-config ' - '-connector-id ' condition: selection falsepositives: - Legitimate usage of Cloudflared. level: medium