Attackers may use non-standard PowerShell curl flags to exfiltrate data or execute malicious payloads covertly. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential command and control activity or data exfiltration attempts that evade traditional detection methods.
KQL Query
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_all("-met", "POST", "-Body")
id: 9cde2f21-35c9-452b-b149-ebbed3d0c7ae
name: Suspicious PowerShell curl flags
description: |
Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing uncommon PowerShell flags to communicate to command-and-control infrastructure.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- DeviceProcessEvents
tactics:
- Execution
- Vulnerability
query: |
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_all("-met", "POST", "-Body")
| Sentinel Table | Notes |
|---|---|
DeviceProcessEvents | Ensure this data connector is enabled |
Scenario: Scheduled job using curl to fetch updates from a trusted internal repository
Filter/Exclusion: ProcessName == "schtasks.exe" || ProcessImage contains "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" && CommandLine contains "https://internal-repo/update"
Scenario: System administrator using curl to download a Windows Update package
Filter/Exclusion: CommandLine contains "https://download.microsoft.com" || User contains "Administrator" || ProcessImage contains "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Scenario: IT team using curl to retrieve a configuration file from a secure internal server
Filter/Exclusion: CommandLine contains "https://config-server.example.com" || User contains "IT" || ProcessImage contains "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Scenario: PowerShell script using curl to fetch a module from the PowerShell Gallery
Filter/Exclusion: CommandLine contains "https://www.powershellgallery.com" || ProcessImage contains "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" && CommandLine contains "Install-Module"
Scenario: Admin using curl to test connectivity to a service endpoint during troubleshooting
Filter/Exclusion: CommandLine contains "https://api.example.com/health" || User contains "Support" || ProcessImage contains "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"