Hayabusa medium test sigma

Curl.EXE Execution With Custom UserAgent

Detects execution of curl.exe with custom useragent options

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_curl": [
    {
      "NewProcessName
| endswith": "\\curl.exe"
    },
    {
      "Product": "The curl executable"
    }
  ],
  "selection_opt": {
    "CommandLine
| contains": [
      " -A ",
      " --user-agent "
    ]
  },
  "condition": "process_creation and (all of selection_*)"
}

False Positives

  • ⚠ Scripts created by developers and admins
  • ⚠ Administrative activity

Field Validations

Loading…

Comments (0)

Loading comments...