Skip to content
Threat Feed
Subscribe
medium advisory

LLM-Based Detection of Suspicious Curl Activity on Linux

Elastic's LLM-based detection rule identifies suspicious `curl` activity on Linux systems, aiming to detect command and control, data exfiltration, or ingress tool transfer by analyzing command-line parameters and network destinations via Auditd Manager or Auditbeat logs, which, if left unaddressed, could lead to system compromise or data breach.

Elastic has developed an LLM-based detection rule designed to identify non-allowlisted curl activity on Linux hosts. This rule leverages telemetry from Auditd Manager or Auditbeat to monitor curl executions, which can be indicators of command and control (C2), data exfiltration, or ingress tool transfer. The system parses and normalizes destination hosts, redacts sensitive command-line information, and aggregates activity by host before utilizing the ES|QL COMPLETION command. An embedded Large Language Model (LLM) then assesses whether the activity is malicious (True Positive), benign (False Positive), or suspicious, with only high-confidence suspicious or true positive verdicts generating alerts. This approach aims to distinguish legitimate automation or package management from actual threats, providing detailed investigative context such as process ancestry, user names, and command samples for further analysis.

Impact

Successful exploitation involving malicious curl activity can lead to severe consequences, including full system compromise through the download and execution of remote payloads, unauthorized data exfiltration to attacker-controlled infrastructure, or establishing persistent command and control channels. This could result in intellectual property theft, ransomware deployment, or long-term presence within the compromised network. While specific victim counts are not provided by this detection rule, any organization relying on Linux systems for critical operations or data processing is a potential target. Organizations that fail to detect and respond to such activity risk significant financial losses, reputational damage, and compliance violations.

Recommendation

  • Ensure Auditd Manager or Auditbeat are deployed and configured to collect Linux process execution events, including process.name, process.args, process.title, process.parent.executable, and user.name, which are essential data sources for the "LLM-Based Curl Activity Triage via Auditd" rule.
  • Configure the Elastic Stack with an appropriate LLM inference endpoint, such as Elastic's managed General Purpose LLM v2 (.gp-llm-v2-completion), as outlined in the setup instructions for the "LLM-Based Curl Activity Triage via Auditd" rule.
  • Establish and regularly update an allow-list for known benign curl destinations within your environment, as suggested for the "LLM-Based Curl Activity Triage via Auditd" rule, to reduce false positives.
  • Actively review alerts generated by the "LLM-Based Curl Activity Triage via Auditd" rule, paying close attention to Esql.verdict, Esql.confidence, and Esql.summary fields for rapid triage and investigation.
  • Implement immediate containment and remediation actions, such as host isolation and blocking of confirmed malicious destinations, based on high-confidence alerts from the "LLM-Based Curl Activity Triage via Auditd" rule.