Suspicious Curl File Upload - Linux
Detects a suspicious curl process start the adds a file to a web request
Sigma rule (View on GitHub)
1title: Suspicious Curl File Upload - Linux
2id: 00b90cc1-17ec-402c-96ad-3a8117d7a582
3related:
4 - id: 00bca14a-df4e-4649-9054-3f2aa676bc04
5 type: derived
6status: test
7description: Detects a suspicious curl process start the adds a file to a web request
8references:
9 - https://twitter.com/d1r4c/status/1279042657508081664
10 - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
11 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
12 - https://curl.se/docs/manpage.html
13 - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
14author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
15date: 2022-09-15
16modified: 2023-05-02
17tags:
18 - attack.exfiltration
19 - attack.command-and-control
20 - attack.t1567
21 - attack.t1105
22logsource:
23 category: process_creation
24 product: linux
25detection:
26 selection_img:
27 Image|endswith: '/curl'
28 selection_cli:
29 - CommandLine|contains:
30 - ' --form' # Also covers the "--form-string"
31 - ' --upload-file '
32 - ' --data '
33 - ' --data-' # For flags like: "--data-ascii", "--data-binary", "--data-raw", "--data-urlencode"
34 - CommandLine|re: '\s-[FTd]\s' # We use regex to ensure a case sensitive argument detection
35 filter_optional_localhost:
36 CommandLine|contains:
37 - '://localhost'
38 - '://127.0.0.1'
39 condition: all of selection_* and not 1 of filter_optional_*
40falsepositives:
41 - Scripts created by developers and admins
42level: medium
References
Related rules
- Cisco Stage Data
- Communication To Ngrok Tunneling Service - Linux
- Communication To Ngrok Tunneling Service Initiated
- Hidden Flag Set On File/Directory Via Chflags - MacOS
- Insensitive Subfolder Search Via Findstr.EXE