Renamed CURL.EXE Execution
This rule detects the execution of a binary that has been renamed from its original 'CURL.exe' name. It identifies this by checking the 'OriginalFileName' and 'Description' fields within the executable's PE metadata. The rule specifically triggers if these fields indicate 'curl.exe' or 'The curl executable', but the actual image path does not contain '\curl', suggesting an attempt to evade detection by renaming the legitimate curl utility.
Sigma
