Insecure Proxy/DOH Transfer Via Curl.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•26

Detects the execution of 'curl.exe' with command-line flags that disable security checks for proxy or DNS over HTTPS (DoH) connections. This behavior can indicate an attempt to bypass security controls or establish covert communication channels.