Sigma rule: Curl Web Request With Potential Custom User-Agent

Rule

Title

Curl Web Request With Potential Custom User-Agent

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-07-27

Modified

2025-12-11

File

rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

Log source

product

windows

category

process_creation

Detection

# Example: This command line would trigger the rule
# curl.exe -H "User-Agent: EvilAgent" http://malicious.example.com
selection_img:
    - Image|endswith: '\curl.exe'
    - OriginalFileName: 'curl.exe'
selection_header_flag_1:
    CommandLine|re: '\s-H\s' # Must be Regex as the flag needs to be case sensitive
selection_header_flag_2:
    CommandLine|contains: '--header'
selection_user_agent:
    CommandLine|contains: 'User-Agent:'
condition: selection_img and 1 of selection_header_* and selection_user_agent

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution

References

• https://labs.withsecure.com/publications/fin7-target-veeam-servers
• https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml