Suspicious Curl Change User Agents - Linux

Title: Suspicious Curl Change User Agents - Linux
Status: test
Description:Detects a suspicious curl process start on linux with set useragent options
References:
  -https://curl.se/docs/manpage.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-15
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    Image|endswith: '/curl'
    CommandLine|contains:
      -' -A '
      -' --user-agent '

  condition:selection
Falsepositives:
  -Scripts created by developers and admins
  -Administrative activity
Level: medium