detection.wiki

Detection rules › Sigma

Suspicious Curl Change User Agents - Linux

Status
test
Severity
medium
Log source
category process_creation, product linux
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects a suspicious curl process start on linux with set useragent options

Known false positives

  • Scripts created by developers and admins
  • Administrative activity

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Telemetry coverage

PlatformRecord / event type
LinuxEvent ID 1: Process Create

Rule body

title: Suspicious Curl Change User Agents - Linux
id: b86d356d-6093-443d-971c-9b07db583c68
related:
    - id: 3286d37a-00fd-41c2-a624-a672dcd34e60
      type: derived
status: test
description: Detects a suspicious curl process start on linux with set useragent options
references:
    - https://curl.se/docs/manpage.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-15
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/curl'
        CommandLine|contains:
            - ' -A '
            - ' --user-agent '
    condition: selection
falsepositives:
    - Scripts created by developers and admins
    - Administrative activity
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Image|endswith: '/curl'
    CommandLine|contains:
        - ' -A '
        - ' --user-agent '

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • --user-agent
  • -A
field:"CommandLine" kind:match
Imageends_with
  • /curl
field:"Image" kind:ends_with value:"/curl"