Local File Read Using Curl.EXE
Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.
Sigma rule (View on GitHub)
1title: Local File Read Using Curl.EXE
2id: aa6f6ea6-0676-40dd-b510-6e46f02d8867
3status: experimental
4description: Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.
5references:
6 - https://curl.se/docs/manpage.html
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2023/07/27
9tags:
10 - attack.execution
11logsource:
12 product: windows
13 category: process_creation
14detection:
15 selection_img:
16 - Image|endswith: '\curl.exe'
17 - OriginalFileName: 'curl.exe'
18 selection_cli:
19 CommandLine|contains: 'file:///'
20 condition: all of selection_*
21falsepositives:
22 - Unknown
23level: medium
References
Related rules
- Potential Cookies Session Hijacking
- Scheduled Task Executing Encoded Payload from Registry
- Scheduled Task Executing Payload from Registry
- Ursnif Redirection Of Discovery Commands
- Suspicious Activity in Shell Commands