File Download From IP URL Via Curl.EXE

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•13

This rule detects the use of 'curl.exe' to download files from an IP address directly specified in the command line. It specifically looks for curl.exe execution, a command line containing an IP address pattern, the 'http' protocol, and common download flags such as '-O', '--remote-name', or '--output'. This activity is often associated with adversaries transferring tools or malware onto a compromised system.