Network utility executed with suspicious URI

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect HTTP requests with patterns that are unusual for a cloud workload.

Strategy

This rule generates a signal when a network utility such as curl or wget makes a request for a URI with an unusual pattern. The patterns used in this rule appeared in previous compromises of cloud resources. For example, it is unusual for a production workload to download a file with a .jpg extension. Threat actors have used this extension to evade detection.

Triage and response

  1. Determine the URL being requested using the process tree.
  2. Identify other compromised systems by searching logs for requests to this URI or domain.
  3. Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization’s internal processes for investigating and remediating compromised systems.

Requires Agent version 7.27 or greater.