Insecure Transfer Via Curl.EXE
Detects the execution of 'curl.exe' with the '--insecure' flag or its shorthand '-k'. This flag tells curl to proceed with insecure SSL connections and transfers, which can be used by adversaries to bypass certificate validation when communicating with command and control servers or exfiltrating data, especially if they are using self-signed certificates or have intercepted traffic.
Sigma
