Command-line HTTP client querying a collaboration platform API

Siemphony@siemphonylowT1213unverified

AN1161 describes curl, wget or a scripted client scraping documentation systems and internal REST APIs, and the only part of that a single process-creation event can carry is the tool plus the endpoint it was pointed at, so this rule ANDs those two fields: a retrieval binary whose command line names a wiki, ticketing, document-library or WebDAV API path. MITRE's CommandRegex knob is the intended home for those patterns; the list here is the author's, drawn from the published Confluence, Jira, SharePoint, GitLab, MediaWiki and Nextcloud endpoint shapes, and a site whose repository sits on another product must extend it or the rule is silent. Two things the analytic asks for are outside Sigma: the burst — AccessVolumeThreshold and TimeWindow are counts over an interval and there is no aggregation here, so one hit is one request and not evidence of bulk collection — and interpreted scrapers, because a Python or Ruby client execs the interpreter and the repository URL usually sits inside the script rather than on the command line. Access through a browser or a native desktop client produces no process event at all and is invisible to this rule. On auditd this needs an execve rule loaded (for example `-a always,exit -F arch=b64 -S execve`); without one the feed is empty and an empty result means blind, not quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0413, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/curl" or FolderPath endswith "/wget") and (ProcessCommandLine contains "/rest/api/content" or ProcessCommandLine contains "/rest/api/space" or ProcessCommandLine contains "/wiki/rest/api/" or ProcessCommandLine contains "/rest/api/2/" or ProcessCommandLine contains "/rest/api/3/" or ProcessCommandLine contains "/_api/web/lists" or ProcessCommandLine contains "/_api/web/getfolderbyserverrelativeurl" or ProcessCommandLine contains "/_vti_bin/" or ProcessCommandLine contains "/api/v4/projects" or ProcessCommandLine contains "/api/v3/repos" or ProcessCommandLine contains "/w/api.php" or ProcessCommandLine contains "/remote.php/dav/files/"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/curl" OR Image="*/wget") AND (CommandLine="*/rest/api/content*" OR CommandLine="*/rest/api/space*" OR CommandLine="*/wiki/rest/api/*" OR CommandLine="*/rest/api/2/*" OR CommandLine="*/rest/api/3/*" OR CommandLine="*/_api/web/lists*" OR CommandLine="*/_api/web/getfolderbyserverrelativeurl*" OR CommandLine="*/_vti_bin/*" OR CommandLine="*/api/v4/projects*" OR CommandLine="*/api/v3/repos*" OR CommandLine="*/w/api.php*" OR CommandLine="*/remote.php/dav/files/*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/curl" OR TO_LOWER(process.executable) LIKE "*/wget") AND (TO_LOWER(process.command_line) LIKE "*/rest/api/content*" OR TO_LOWER(process.command_line) LIKE "*/rest/api/space*" OR TO_LOWER(process.command_line) LIKE "*/wiki/rest/api/*" OR TO_LOWER(process.command_line) LIKE "*/rest/api/2/*" OR TO_LOWER(process.command_line) LIKE "*/rest/api/3/*" OR TO_LOWER(process.command_line) LIKE "*/_api/web/lists*" OR TO_LOWER(process.command_line) LIKE "*/_api/web/getfolderbyserverrelativeurl*" OR TO_LOWER(process.command_line) LIKE "*/_vti_bin/*" OR TO_LOWER(process.command_line) LIKE "*/api/v4/projects*" OR TO_LOWER(process.command_line) LIKE "*/api/v3/repos*" OR TO_LOWER(process.command_line) LIKE "*/w/api.php*" OR TO_LOWER(process.command_line) LIKE "*/remote.php/dav/files/*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/curl$|/wget$)</field>    <field name="CommandLine" type="pcre2">(?i)(/rest/api/content|/rest/api/space|/wiki/rest/api/|/rest/api/2/|/rest/api/3/|/_api/web/lists|/_api/web/getfolderbyserverrelativeurl|/_vti_bin/|/api/v4/projects|/api/v3/repos|/w/api\.php|/remote\.php/dav/files/)</field>    <description>Command-line HTTP client querying a collaboration platform API</description>    <mitre>      <id>T1213</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: bfa88fdc-6858-4fe3-94e7-1d02096e3274

ATT&CKT1213

T1213Data from Information Repositories

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

Command-line retrieval against an internal knowledge repository. MITRE's AN1161 — the Linux analytic under DET0413 — describes curl, rsync, wget or custom scripts scraping documentation systems and internal REST APIs. A single process-creation event carries only two useful facts: which tool ran, and what it was pointed at. The rule ANDs exactly those two and claims nothing more.

02 · Telemetry you need

Linux process creation with the command line intact — the brief's process_creation / linux source, fed in practice by auditd execve. auditd records no execve out of the box, so you need a rule such as -a always,exit -F arch=b64 -S execve loaded first. Without one the feed is empty, and an empty result reads as "quiet" when it actually means blind. The analytic's other source, Linux Sysmon EventID 3/22, carries the connection but not the URL path, so it cannot support this logic.

03 · How the logic works

Two blocks, ANDed. selection_tool matches Image|endswith on /curl and /wget. selection_repository matches CommandLine|contains against twelve endpoint fragments drawn from published API shapes: Confluence (/rest/api/content, /rest/api/space, /wiki/rest/api/), Jira (/rest/api/2/, /rest/api/3/), SharePoint (/_api/web/lists, /_api/web/getfolderbyserverrelativeurl, /_vti_bin/), GitLab (/api/v4/projects), GitHub Enterprise (/api/v3/repos), MediaWiki (/w/api.php) and Nextcloud WebDAV (/remote.php/dav/files/). MITRE names the CommandRegex knob — "regex matching internal doc servers, knowledge base paths, or IP patterns" — as the intended home for that list. The twelve values in it are the pipeline's own, not MITRE's, and a site whose repository runs on a different product will get silence rather than coverage until the list is extended. Two things the analytic asks for are simply outside Sigma. The burst is one: MITRE's AccessVolumeThreshold and TimeWindow knobs are counts over an interval, and there is no aggregation here, so one hit is one HTTP request and not evidence of bulk collection. Interpreted scrapers are the other: a Python or Ruby client execs the interpreter, and the repository URL usually lives inside the script rather than on the command line. Browser and native-client access produces no process event at all.

04 · Common false positives

The largest source by a wide margin is scheduled monitoring — Nagios, Zabbix and similar agents curling a Confluence, Jira or GitLab endpoint every few minutes, forever, with nothing in the event to separate a health probe from a page pull. Next is automation: CI jobs publishing release notes through the Confluence API, exporting a space before an upgrade, or reading Jira issue metadata inside a pipeline step. Backup and migration scripts that walk a team drive over the SharePoint or Nextcloud WebDAV path with wget produce precisely the mass-retrieval shape the analytic describes, run by the data's own owner. An engineer testing an endpoint by hand while debugging authentication rounds it out. Hence level: low.

05 · Detection maturity

tier_1: Lowest tier, and it remains there until the rule has been run against real data. It is machine-derived from a MITRE scaffold and has never touched a log line: no confirmed detection, no measured noise floor, no coverage estimate. Run it over a historical window, see how much of the output is your own monitoring stack, and treat that number as the rule's first real measurement.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Start by excluding the monitoring service accounts and CI runner hosts by identity, not by URL — they are stable and they are most of the volume. Then extend selection_repository with your own products' paths; the shipped list is a starting shape, not an inventory. Because volume is where the signal actually lives, pair the rule with a SIEM-side count per user per hour and alert on the aggregate rather than the single event, which is what MITRE's AccessVolumeThreshold and TimeWindow knobs are asking for. Adding /usr/bin/python3 to selection_tool will not help — the path is in the script, not the argv.

Declared by the author

Scheduled monitoring and synthetic checks. Nagios, Zabbix and similar agents curl a Confluence, Jira or GitLab REST endpoint every few minutes from a Linux host, which is continuous and by a wide margin the largest source of matches here; nothing in the event separates a health probe from a page pull.
Documentation-as-code and release automation. CI jobs that publish release notes through the Confluence REST API, export a space before an upgrade, or read issue metadata from Jira with curl inside a pipeline step.
Backup and migration scripts that walk a team drive over the SharePoint or Nextcloud WebDAV path with wget to archive it, which is exactly the mass-retrieval shape the analytic describes but run by the storage owner.
An administrator or developer testing an endpoint by hand — a single curl against the wiki API while debugging authentication or a broken integration.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1213, evaluated against their process_creation events.

Share this rule

/u/siemphony/bfa88fdc-6858-4fe3-94e7-1d02096e3274

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Command-line HTTP client querying a collaboration platform API

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it