CmdID / Files

curl.exe

The curl executable file version info

Program on Windows 4 known copies with hashes 35 Sigma rules name it

Is it the real curl.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductThe curl executable, curl, https://curl.haxx.se/

DescriptionThe curl executable

4 known copies

7.55.1 · C:\Windows\system32\curl.exe · signed by Microsoft Windows

0ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205

7.55.1 · C:\Windows\SysWOW64\curl.exe · signed by Microsoft Windows

126217cb9e37d9cf3b254e13a4e2b257ffffae54728892d00e868d56de726071

7.55.1 · C:\Windows\system32\curl.exe · signed by Microsoft Windows

c53b0901c262071da3f3fbb69c30c2c26e2ab7866c7c42183c830b9a609c7994

7.55.1 · C:\Windows\SysWOW64\curl.exe · signed by Microsoft Windows

f835e15aceb0e995ead000641019aec2162f74d45c5732cee9e3c77d13fa038a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name curl.exe

criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

criticalQakbot Rundll32 Exports ExecutionX__Junior (Nextron Systems)

criticalQakbot Rundll32 Fake DLL Extension ExecutionX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highAxios NPM Compromise Indicators - WindowsSwachchhanda Shrawan Poudel (Nextron Systems)

highCurl File Upload To File Sharing WebsitesSwachchhanda Shrawan Poudel (Nextron Systems)

highKalambur Backdoor Curl TOR SOCKS Proxy ExecutionArda Buyukkaya (EclecticIQ)

highNTLM Hash Leak Via Curl NTLM AuthenticationSwachchhanda Shrawan Poudel (Nextron Systems)

highPotential Data Exfiltration Activity Via CommandLine ToolsNasreddine Bencherchali (Nextron Systems)

highPotential Qakbot Rundll32 ExecutionX__Junior (Nextron Systems)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Curl.EXE DownloadFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSuspicious Download from Office DomainFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSuspicious File Download From File Sharing Domain Via Curl.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious File Download From IP Via Curl.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious ShellExec_RunDLL Call Via OrdinalSwachchhanda Shrawan Poudel

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumCurl Web Request With Potential Custom User-AgentNasreddine Bencherchali (Nextron Systems)

mediumCurl.EXE Execution With Custom UserAgentfrack113

mediumFile Download From IP URL Via Curl.EXENasreddine Bencherchali (Nextron Systems)

mediumFile Download Via Curl.EXEFlorian Roth (Nextron Systems)

mediumInsecure Proxy/DOH Transfer Via Curl.EXENasreddine Bencherchali (Nextron Systems)

mediumInsecure Transfer Via Curl.EXEX__Junior (Nextron Systems)

mediumLocal File Read Using Curl.EXENasreddine Bencherchali (Nextron Systems)

mediumPotential Cookies Session HijackingNasreddine Bencherchali (Nextron Systems)

mediumPotential Data Exfiltration Via Curl.EXEFlorian Roth (Nextron Systems), Cedric MAURUGEON (Update)

And 3 more process creation rules that name curl.exe.

Sigma names curl.exe in 35 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.