Suspicious HTTP URL Invocation Patterns via Download Utilities

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious command line patterns involving download utilities like curl or wget invoking invalidly formatted HTTP protocols (e.g., 'http:/example.com' instead of 'http://example.com'). This may indicate an attempt to obfuscate the URL or bypass certain detection mechanisms while still reaching out to external servers for command and control or data exfiltration.

Internal Research

2026-03-18 00:00:00

None

cda80579-48f2-4b72-95b9-48ba1d858ab1

attack.command-and-control attack.execution attack.t1105 attack.t1071.001 attack.defense-evasion attack.t1027.010

Nextron Sigma feed only (private)