Curl.EXE Execution With Custom User-Agent

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the execution of 'curl.exe' when a custom User-Agent string is specified using either the '-A' or '--user-agent' command-line options. This behavior can be indicative of an adversary attempting to mimic legitimate web traffic while using a non-standard User-Agent to evade detection or to identify themselves to a C2 server.