Curl Download And Execute Combination

Title: Curl Download And Execute Combination
Status: test
Description:Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.
References:
  -https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983
Author: Sreeman, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-01-13
modified:2024-03-05
Tags:

• -'attack.stealth'
• -'attack.t1218'
• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|windash: ' -c '
    CommandLine|contains|all:
      -'curl '
      -'http'
      -'-o'
      -'&'

  condition:selection
Falsepositives:
  -Unknown
Level: high