File Download Via Curl.EXE

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": "\\curl.exe"
    },
    {
      "Product": "The curl executable"
    }
  ],
  "selection_remote": {
    "CommandLine
| contains": [
      " -O",
      "--remote-name",
      "--output"
    ]
  },
  "condition": "process_creation and (all of selection_*)"
}

False Positives

• ⚠ Scripts created by developers and admins
• ⚠ Administrative activity
• ⚠ The "\Git\usr\bin\sh.exe" process uses the "--output" flag to download a specific file in the temp directory with the pattern "gfw-httpget-xxxxxxxx.txt "