Query: alert when Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Matching passage: Sigma rule: Detects a suspicious curl process start on Windows and outputs the requested document to a local file. Logsource: windows / process_creation. Rule: title: Suspicious Curl.EXE Download id: e218595b-bbe7-4ee5-8a96-f32a24ad3468 related: - id: bbeaed61-1990-4773-bf57-b81dbad7db2d type: derived - id: 9a517fca-4ba3-4629-9278-a68694697b81 type: similar status: test description: Detects a suspicious curl process start on Windows and outputs the requested document to a local file references: - https://twitter.com/max_mal_/status/1542461200797163522 - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464 - https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt - https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/ - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-07-03 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_curl: - Image|endswith: \curl.exe - Product: The curl executable selection_susp_locations: CommandLine|contains: - '%AppData%' - '%Public%' - '%Temp%' - '%tmp%' - \AppData\ - \Desktop\ - \Temp\ - \Users\Public\ - C:\PerfLogs\ - C:\ProgramData\ - C:\Windows\Temp\ selection_susp_extensions: CommandLine|endswith: - .dll - .gif - .jpeg - .jpg - .png - .temp - .tmp - .txt - .vbe - .vbs filter_optional_git_windows: ParentImage: C:\Program Files\Git\usr\bin\sh.exe Image: C:\Program Files\Git\mingw64\bin\curl.exe CommandLine|contains|all: - '--silent --show-error --output ' - gfw-httpget- - AppData condition: selection_curl and 1 of selection_susp_* and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/info.yml simulation: - type: atomic-red-team name: Curl Download File technique: T1105 atomic_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a
Near-miss passage: Sigma rule: Detects usage of Dsacls to grant over permissive permissions. Logsource: windows / process_creation. Rule: title: Potentially Over Permissive Permissions Granted Using Dsacls.EXE id: 01c42d3c-242d-4655-85b2-34f1739632f7 status: test description: Detects usage of Dsacls to grant over permissive permissions references: - https://ss64.com/nt/dsacls.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsacls.exe - OriginalFileName: DSACLS.EXE selection_flag: CommandLine|contains: ' /G ' selection_permissions: CommandLine|contains: - GR - GE - GW - GA - WP - WD condition: all of selection_* falsepositives: - Legitimate administrators granting over permissive permissions to users level: medium