Why curl and wget rules are noisy in cloud environments

Attackers often transfer tools or payloads after they compromise a host. MITRE ATT&CK maps this behavior to Ingress Tool Transfer, T1105 and explicitly calls out curl and wget as common Linux utilities for moving files into a victim environment. In a cloud environment, that makes these binaries worth watching. The hard part isn’t writing the first rule; it’s keeping the rule useful after the first week. Cloud hosts lean on curl and wget constantly, whether they’re used to pull packages, retrieve build artifacts, or handle basic setup tasks.

CI workers grab the outputs they need, and Kubernetes jobs call metadata endpoints. Infrastructure tools request configuration from their sources, and security scanners test reachable services. Every one of those can look like "a process downloaded something from the internet" if the rule only looks at the binary name and URL. You can measure this in your own environment before you enable anything. This ES|QL query parses the destination host out of every curl and wget execution and ranks destinations by volume, so you can see what a name-and-URL-only rule would surface across your fleet: /* Update these index patterns to match where your process events live.

ECS data tags process events with event. category "process"; Auditbeat uses event. action "executed". */ FROM logs-*, auditbeat-* | WHERE (event. category == "process" OR event.

action == "executed") AND process. name IN ("curl", "wget") AND process. args IS NOT NULL | EVAL args_str = CONCAT(" ", MV_CONCAT(process. args, " ")) | GROK args_str "%{URIPROTO:url_proto}://%{URIHOST:dest_host}" | WHERE dest_host IS NOT NULL /* URIHOST keeps the port, so localhost:8080 and localhost:9200 count separately. Drop the trailing :port to group destinations by host.

*/ | EVAL dest_host = REPLACE(dest_host, ":[0-9]+$", "") | STATS event_count = COUNT(*), host_count = COUNT_DISTINCT(COALESCE(host. id, host. name)) BY dest_host, process.