Windows Curl Download to Suspicious Path Detection

This threat brief describes a detection for the use of curl.exe on Windows systems to download files into directories commonly abused by attackers for persistence, defense evasion, or temporary storage of malicious payloads. These locations include AppData, ProgramData, PerfLogs, Windows\Temp, and Users\Public. Attackers leverage the legitimate curl.exe utility to retrieve malicious executables, scripts, or other files, often using command-line options like -O (output to file) or --output to specify a destination path. By placing files in these system or user-specific directories, adversaries attempt to blend in with legitimate system activity, maintain access, or facilitate further stages of an attack. This activity, while sometimes legitimate for administrative tasks, is highly suspicious in typical enterprise environments and warrants investigation due to its potential for leading to unauthorized code execution, data exfiltration, or further system compromise.

Attack Chain

This brief focuses on a specific detection scenario rather than a multi-stage attack chain, as it targets a common technique used across various campaigns. The observed behavior that triggers this detection is:

1. An attacker executes curl.exe on a compromised Windows system, typically via a command prompt, PowerShell, or a malicious script.
2. The curl.exe process is initiated with command-line arguments to download a file from a remote source.
3. The command line includes download flags such as -O, --output, or --output-dir.
4. The specified destination for the downloaded file is a suspicious path, such as C:\ProgramData\, C:\Users\<user>\AppData\, C:\Users\Public\, C:\PerfLogs\, C:\Windows\Temp\, or their respective environment variable equivalents (%AppData%, %Public%, %Temp%).
5. The curl.exe process successfully retrieves and saves the remote file to the designated suspicious directory.
6. This action may serve as a precursor to establishing persistence, loading a malicious payload, or further exploiting the system.

Impact

If this activity is confirmed as malicious, the impact can range from initial compromise leading to unauthorized code execution to more severe outcomes. Successful exploitation often leads to the download and execution of additional malware, such as ransomware, information stealers, or backdoors. This can result in significant data exfiltration, disruption of operations, financial loss, and reputational damage. While the detection itself does not imply immediate compromise, it flags a critical step commonly employed in various attack campaigns (e.g., IcedID, Black Basta, APT37) to deliver payloads and establish a foothold, making early detection crucial.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
• Enable Sysmon process-creation logging to activate the rule and collect necessary Image and CommandLine telemetry.
• Configure Windows Event Log Security (Event ID 4688) for process creation with command-line auditing to provide the required data for the rule.
• Review network egress logs for curl.exe making outbound connections to unusual or suspicious domains, especially when combined with suspicious file writes.