Elastic medium stable eql

Potential Data Exfiltration Through Curl

Detects the use of curl to upload files to an internet server. Threat actors often will collect and exfiltrate data on a system to their C2 server for review. Many threat actors have been observed using curl to upload the collected data. Use of curl in this way, while not inherently malicious, should be considered highly abnormal and suspicious activity.

View Source

Detection Logic

process where event.type == "start" and 
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name : ("curl", "curl.exe") and 
(
  process.args in ("-T", "--upload-file") or
  (
    (process.args in ("-F", "-d", "--form") or process.args like "--data*") and process.command_line like "*@*"
  )
) and
(
  process.command_line like ("*http:*", "*https:*", "*ftp:*", "*ftps:*") or
  process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
) and 
not (
  process.args : (
    "https://*/ap/fleet/*", "https://*/api/saved_objects/*", "http*localhost:*", "http*127.0.0.*", "*ApiKey*", "http*.us-central1.run.app/*",
    "*Authorization*", "*session.id*", "http*.elastic-cloud.com*", "http*.elastic.dev*", "http*.elastic.cloud*", "http*.aws.found.io*",
    "http*.gcp.cloud.es.io*", "http*.cisco.com/api/*", "-u", "http://192.168*",
    "*incoming.telemetry.mozilla.org*", "*cloudamize.com*"
  ) or
  process.args == "--unix-socket" or
  process.parent.name like "clevis*" or
  process.parent.executable in ("/usr/bin/clevis-decrypt-tang", "/bin/clevis-decrypt-tang") or
  (
    process.parent.command_line like "*oracle/retina/vvaa-*" and
    process.working_directory == "/home/oracle"
  ) or
  (
    process.working_directory == "/home/oracle" and
    process.args == "--trace" and
    process.parent.executable like "/home/oracle/retina/vvaa-*-oracle/app/*.sh"
  ) or
  (
    process.working_directory == "/home/service/common/system.check" and
    process.parent.command_line == "/bin/bash ./check.sh"
  ) or
  (
    process.parent.executable == "C:\\Windows\\SysWOW64\\cmd.exe" and
    process.parent.args like "?:\\*\\temp-app\\caller_batch_*.bat"
  ) or
  (
    process.parent.executable == "/opt/rudder/share/commands/agent-run" and
    process.parent.command_line == "/bin/sh /opt/rudder/share/commands/agent-run -uRN" and
    process.args like "/var/rudder/reports/ready/*"
  ) or
  (
    process.parent.executable like "/var/lib/docker/overlay2/*/merged/usr/bin/bash" and
    process.parent.command_line like "bash /home/*/old/scripts/crawler.sh start"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...