Curl Web Request With Potential Custom User-Agent

SigmaHQ Detections@sigmaHQ

•updated Dec 25, 2025•0•0•0

Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings