Curl Usage on Linux

A Sigma rule for process creation on Linux, by Nasreddine Bencherchali (Nextron Systems).

low 1 ATT&CK technique 1 program it names 15 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    Image|endswith: '/curl'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Make an HTTP GET request and dump the contents in stdout on the page for curl

curl https://example.comIdentify

Make an HTTP GET request, follow any 3xx redirects, and dump the reply headers and contents to stdout on the page for curl

curl --location --dump-header - https://example.comIdentify

Download a file, saving the output under the filename indicated by the URL on the page for curl

curl --remote-name https://example.com/filename.zipIdentify

Open JSON data from a URL on the page for fx

curl url | fxIdentify

Apply and commit changes following a remote patch file on the page for git-am

curl --location https://example.com/file.patch | git amIdentify

Apply a remote patch file on the page for git-apply

curl --location https://example.com/file.patch | git applyIdentify

View an HLS manifest from a URL on the page for hlsq

curl --silent url | hlsqIdentify

View multiple images from the web on the page for imv

curl --remote-name --silent --write-out '%{filename_effective}\n' 'http://www.example.com/[1-10].jpg' | imvIdentify

Read through raw HTML and summarize the contents, in markdown format on the page for mods

curl "https://api.open-meteo.com/v1/forecast?latitude=29.00&longitude=-90.00&current_weather=true&hourly=temperature_2m,relativehumidity_2m,windspeed_10m" | mods --format "summarize this weather data for a human"

Identify

Pass Prometheus metrics over stdin to check them for consistency and correctness on the page for promtool

curl --silent http://example.com:9090/metrics/ | promtool check metricsIdentify

Download and run rustup-init to install rustup and the default Rust toolchain on the page for rustup-init.sh

curl https://sh.rustup.rs --silent --show-error --fail | sh -sIdentify

Download and run rustup-init and pass arguments to it on the page for rustup-init.sh

curl https://sh.rustup.rs --silent --show-error --fail | sh -s -- argumentsIdentify

And 3 more examples on CmdID’s program pages.

The commands LOLBAS or GTFOBins documents for curl trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

curl

ATT&CK

the techniques it is tagged with

T1105Ingress Tool Transfer

Curl Usage on Linux

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1105 Ingress Tool Transfer