title: Suspicious Curl Change User Agents
id: 3286d37a-00fd-41c2-a624-a672dcd34e60
status: experimental
description: Detects a suspicious curl process start on Windows with set useragent options
author: frack113
references:
  - https://curl.se/docs/manpage.html
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1071.001/T1071.001.md#atomic-test-2---malicious-user-agents---cmd
date: 2022/01/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_curl:
    - Image|endswith: '\curl.exe'
    - Product: 'The curl executable'
  selection_opt:
    CommandLine|contains:
      - ' -A '
      - ' --user-agent '
  condition: all of selection_*
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.001
