Ingress Tool Transfer via CURL

[rule]
description = """
Identifies downloads of remote content using Windows CURL executable. This tactic may be indicative of malicious
activity where malware is downloading second stage payloads using built-in Windows programs.
"""
id = "336ada1c-69f8-46e8-bdd2-790c85429696"
license = "Elastic License v2"
name = "Ingress Tool Transfer via CURL"
os_list = ["windows"]
version = "1.0.34"

query = '''
process where event.action == "start" and

 /* renamed curl or curl running from normal users writable folders are very noisy */
 process.executable : ("?:\\Windows\\System32\\curl.exe", "?:\\Windows\\SysWOW64\\curl.exe") and

 (
  (process.args_count == 2 and process.command_line : "*http*" and process.parent.name : "cmd.exe" and
   process.parent.command_line : "*  /c curl*") or

  (process.args : ("-o", "--output") and
   (
    (process.parent.name : ("powershell.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe") and
     process.parent.args_count >= 2) or

     (process.parent.name : "cmd.exe" and process.parent.command_line : ("*curl*", "*^*^*^*")) or

     descendant of [process where process.name : ("winword.exe", "excel.exe", "powerpnt.exe", "wscript.exe")] or

     process.parent.executable : ("?:\\Users\\Public\\*", "?:\\Users\\*\\AppData\\*", "?:\\ProgramData\\*")
   ))
  ) and
  /* lot of legit curl execution via custom bat scripts or interactively via cmd or powershell */
  not (process.parent.name : "cmd.exe" and process.parent.args :( "*.bat*", "\\\\*.jpg", "curl -L -o \\\\*", "config_%c%a%b_%d%e%f.xml")) and
  not (process.parent.name : ("cmd.exe", "powershell.exe") and process.parent.args_count == 1) and
  not process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\nsc*.tmp\\*.exe" and
  not process.command_line : ("*curl -o \\\\.\\nul -v -I -L -s --connect-timeout*", "*http://127.0.0.1:*", "*http://localhost:*") and
  not process.args : ("https://mirror.init7.net/ctan/systems*", "http://localhost:*",
                      "https://*.ctan.org*", "texlive/curl", "http*.local/*",
                      "http://control.firstvoucher.com/api/build/*zip",
                      "https://blackhole.blob.core.windows.net/*",
                      "https://*.cw-onlineupdate.de/*",
                      "https://gitea.*.prod/*",
                      "https://dl.google.com/*") and

  /* avoid breaking privileged install */
  not user.id : "S-1-5-18" and
  not (process.parent.name : "cmd.exe" and process.parent.command_line like~ "*oi-vscode-server*run.app*") and
  not (process.parent.name : "cmd.exe" and process.parent.command_line like~ "*nexuspayables.com*showImage.php*") and
  not (process.parent.command_line like~ "*VoicemodInstaller*" and process.parent.name like~ "VoicemodInstaller*")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"