CVE-2023-27533

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "curl" and InitiatingProcessCommandLine contains "telnet://"
| where ProcessCommandLine matches regex "telnet://.*\s-d\s.*" or ProcessCommandLine matches regex "telnet://.*\s--data\s.*" // Example: looking for data injection via telnet
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath

Splunk SPL

index=* sourcetype=WinEventLog:Security EventCode=4688 OR sourcetype=linux_audit (type=SYSCALL AND a0="execve")
| where CommandLine LIKE "%curl%" AND CommandLine LIKE "%telnet://%"
| where CommandLine LIKE "%telnet://% -d %" OR CommandLine LIKE "%telnet://% --data %"
| table _time, host, CommandLine, ParentCommandLine, Image

Sigma

title: Curl Telnet Option Injection Attempt
id: 7a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2023-27533 in curl via TELNET protocol, where an attacker might inject malicious options or data.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-27533
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\curl.exe'
    CommandLine|contains:
      - 'telnet://'
      - '-d'
      - '--data'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - User
level: high

Elastic ES|QL

from process where process.executable : "*curl.exe" and process.command_line : "*telnet://*" and (process.command_line : "* -d *" or process.command_line : "* --data *")