Suspicious Curl Command with Custom User Agent on Linux

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects the execution of the 'curl' command on Linux systems when it includes options to set a custom user agent. This behavior can be indicative of command and control communication or data exfiltration attempts where an adversary tries to mimic legitimate web traffic or evade detection by changing the default user agent string.