Query: rule covering Detects potentially suspicious file download from file sharing domains using curl.exe
Matching passage: Sigma rule: Detects potentially suspicious file download from file sharing domains using curl.exe. Logsource: windows / process_creation. Rule: title: Suspicious File Download From File Sharing Domain Via Curl.EXE id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb related: - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects potentially suspicious file download from file sharing domains using curl.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 modified: 2026-03-29 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_websites: CommandLine|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at selection_http: CommandLine|contains: http selection_flag: CommandLine|contains: - ' -O' - --remote-name - --output selection_ext: CommandLine|endswith: - .ps1 - .ps1' - .ps1" - .dat - .dat' - .dat" - .msi - .msi' - .msi" - .bat - .bat' - .bat" - .exe - .exe' - .exe" - .vbs - .vbs' - .vbs" - .vbe - .vbe' - .vbe" - .hta - .hta' - .hta" - .dll - .dll' - .dll" - .psm1 - .psm1' - .psm1" condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/info.yml
Near-miss passage: Sigma rule: Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent. Logsource: windows / process_creation. Rule: title: HackTool - PPID Spoofing SelectMyParent Tool Execution id: 52ff7941-8211-46f9-84f8-9903efb7077d status: test description: Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent references: - https://pentestlab.blog/2020/02/24/parent-pid-spoofing/ - https://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks - https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing - https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files author: Florian Roth (Nextron Systems) date: 2022-07-23 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.004 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SelectMyParent.exe - CommandLine|contains: - PPID-spoof - ppid_spoof - spoof-ppid - spoof_ppid - ppidspoof - spoofppid - spoofedppid - ' -spawnto ' - OriginalFileName|contains: - PPID-spoof - ppid_spoof - spoof-ppid - spoof_ppid - ppidspoof - spoofppid - spoofedppid - Description: SelectMyParent - Hashes|contains: - IMPHASH=04D974875BD225F00902B4CAD9AF3FBC - IMPHASH=A782AF154C9E743DDF3F3EB2B8F3D16E - IMPHASH=89059503D7FBF470E68F7E63313DA3AD - IMPHASH=CA28337632625C8281AB8A130B3D6BAD condition: selection falsepositives: - Unlikely level: high