Browser Initiated Curl Download via Command Shell

Subash Ghimire@iamsubashg

•updated Aug 20, 2025•4•1•62

This rule detects suspicious command-line activity, specifically file downloads using 'curl' initiated by a web browser. This behavior may indicate malicious JavaScript or HTML triggering command execution, a user being tricked into clicking a link that launches a command, or initial access/payload download in a phishing or drive-by attack.