Renamed CURL.EXE Execution

Title: Renamed CURL.EXE Execution
Status: test
Description:Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
References:
  -https://twitter.com/Kostastsale/status/1700965142828290260
Author: X__Junior (Nextron Systems)
Date: 2023-09-11
modified:2023-10-12
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
OriginalFileName:'curl.exe' Description:'The curl executable'   filter_main_img:
    Image|contains: '\curl'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium