curl or wget overrides the Host header to impersonate a cloud service

Siemphony@siemphonymediumT1001.003unverifiedPlaybook · Collection and exfiltration

AN1295 asks for a binary spawning an encrypted session that simulates trusted cloud service traffic. curl and wget are the two LOLBins on Linux that can force an explicit Host header independent of the connection target, which is exactly the header-manipulation impersonation the parent technique describes for Gmail, Google Drive and similar services — a legitimate call to the real API sets no Host override at all, since the URL already resolves to the right host. The domain list below is populated here, not sourced from MITRE, as a small sample of high-trust cloud endpoints an adversary would plausibly spoof to blend C2 traffic past domain allowlisting. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0470, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: curl or wget overrides the Host header to impersonate a cloud service2id: e6a2c450-237d-4a69-89ec-23bcae7c2a903status: experimental4description: |5  AN1295 asks for a binary spawning an encrypted session that simulates6  trusted cloud service traffic. curl and wget are the two LOLBins on Linux7  that can force an explicit Host header independent of the connection8  target, which is exactly the header-manipulation impersonation the parent9  technique describes for Gmail, Google Drive and similar services — a10  legitimate call to the real API sets no Host override at all, since the URL11  already resolves to the right host. The domain list below is populated here,12  not sourced from MITRE, as a small sample of high-trust cloud endpoints an13  adversary would plausibly spoof to blend C2 traffic past domain allowlisting.14  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0470, not hand-written and not tested by its author. Any lab result is on this rule's own page.15references:16  - https://attack.mitre.org/techniques/T1001/00317  - https://attack.mitre.org/detectionstrategies/DET047018author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)19date: 2026-08-1620tags:21  - attack.command-and-control22  - attack.t1001.00323logsource:24  category: process_creation25  product: linux26detection:27  selection_tool:28    Image|endswith:29      - '/curl'30      - '/wget'31  selection_header:32    CommandLine|contains:33      - 'Host: mail.google.com'34      - 'Host: docs.google.com'35      - 'Host: www.dropbox.com'36      - 'Host: login.live.com'37  condition: selection_tool and selection_header38falsepositives:39  - "Load-balancer or CDN health-check scripts that intentionally override the Host header to validate a virtual-hosted backend for one of these same cloud domains."40  - "API integration test suites that curl an internal mock or sandbox endpoint by IP while setting the Host header to the real service domain, to exercise vhost-based routing before it goes live."41level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/curl" or FolderPath endswith "/wget") and (ProcessCommandLine contains "Host: mail.google.com" or ProcessCommandLine contains "Host: docs.google.com" or ProcessCommandLine contains "Host: www.dropbox.com" or ProcessCommandLine contains "Host: login.live.com"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/curl" OR Image="*/wget") AND (CommandLine="*Host: mail.google.com*" OR CommandLine="*Host: docs.google.com*" OR CommandLine="*Host: www.dropbox.com*" OR CommandLine="*Host: login.live.com*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/curl" OR TO_LOWER(process.executable) LIKE "*/wget") AND (TO_LOWER(process.command_line) LIKE "*host: mail.google.com*" OR TO_LOWER(process.command_line) LIKE "*host: docs.google.com*" OR TO_LOWER(process.command_line) LIKE "*host: www.dropbox.com*" OR TO_LOWER(process.command_line) LIKE "*host: login.live.com*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/curl$|/wget$)</field>    <field name="CommandLine" type="pcre2">(?i)(Host: mail\.google\.com|Host: docs\.google\.com|Host: www\.dropbox\.com|Host: login\.live\.com)</field>    <description>curl or wget overrides the Host header to impersonate a cloud service</description>    <mitre>      <id>T1001.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e6a2c450-237d-4a69-89ec-23bcae7c2a90

ATT&CKT1001.003

T1001.003Protocol or Service Impersonation

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1001.003, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Swap the rejected health-check FP for the reviewer's gateway/proxy
MITRE's TimeWindow knob (spawn-to-session correlation) and
Expand past the four hardcoded domains with care: any Host value outside

Declared by the author

Load-balancer or CDN health-check scripts that intentionally override the Host header to validate a virtual-hosted backend for one of these same cloud domains.
API integration test suites that curl an internal mock or sandbox endpoint by IP while setting the Host header to the real service domain, to exercise vhost-based routing before it goes live.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN1295 asks for a binary spawning an encrypted session that impersonates trusted cloud-service traffic — OpenSSL/curl-style tools connecting out with headers that don't match the real destination. This rule authors that as: curl or wget invoked with a command-line Host: header naming one of four cloud domains — mail.google.com, docs.google.com, www.dropbox.com, login.live.com. A legitimate call to any of those services never sets an explicit Host override, because the URL it connects to already resolves there; setting one is itself the impersonation signal.

02 · Telemetry you need

auditd:SYSCALL::execve, mapped to Sigma's process_creation/linux logsource — the brief's only log source for AN1295. CommandLine must actually be captured on execve; standard auditd EXECVE records reconstruct argv, so a -H 'Host: ...' argument survives as one token in CommandLine even though shell quoting splits it at the syscall layer.

03 · How the logic works

Both selections must match: the tool alone is far too common, so the rule pairs it with an explicit Host: substring. The four-domain list is the author's own sample of high-trust endpoints worth spoofing past domain allowlisting — it is not MITRE's; MITRE's HeaderSignatureMatch knob only names the category of thing to look for (header anomalies, missing User-Agent), not any specific domain. The rendered Sentinel query confirms the AND: (FolderPath endswith "/curl" or ...) and (ProcessCommandLine contains "Host: mail.google.com" or ...).

04 · Common false positives

Two false positives are listed, and the reviewer rejected the first one on inspection: "load-balancer or CDN health-check scripts validating a vhost backend for one of these same cloud domains" was flagged as not real operational practice — organizations don't run health checks against third-party public-cloud vhosts they don't own. The reviewer's own suggested replacement is more plausible and currently missing from the rule: a corporate API gateway or internal reverse proxy that legitimately rewrites Host to login.live.com or similar while fronting the real upstream service. The second listed FP — API test suites curling an internal mock while setting Host to the real service domain to exercise vhost routing — held up under review.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0470 and never executed against logs. Only AN1295's Linux leg is authored; AN1294 (Windows, Sysmon 3/22 TLS/certificate and DNS metadata) and AN1296 (macOS, Unified Log network plus osquery process/hash) are untouched — this rule sees none of the certificate-mismatch behavior the strategy's name foregrounds.
tier_2: means replacing the rejected FP and validating the domain list against real proxy traffic;
tier_3: means the TLS-fingerprint correlation AN1294 actually describes.

Related detections1 nearby

HTTP client fronting a CDN edge with an overridden Host header

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/e6a2c450-237d-4a69-89ec-23bcae7c2a90

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

curl or wget overrides the Host header to impersonate a cloud service

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it