<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Interesting question!</p>
<p>Searching the Qgis source code in Github on "curl" I found one
reference to "curl", in "qgsnetworkloggernode.cpp"<br>
See for yourself at
<a class="moz-txt-link-rfc2396E" href="https://github.com/search?q=repo%3Aqgis%2FQGIS+curl&type=code">"https://github.com/search?q=repo%3Aqgis%2FQGIS+curl&type=code"</a><br>
<br>
</p>
<p>I guess this is triggered when you use the debugging/development
tools panel (in the menu under "view"->"panels")<br>
Could that be the ASR-trigger for curl.exe?</p>
<p><br>
</p>
<p>Can't find references to Powershell(.exe), so that surprises me. </p>
<p>Just to make sure: are you using a "clean" QGis, or do you have
some plugins installed?</p>
<p><br>
</p>
<p>Kind regards, </p>
<p>Gert-Jan</p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 9/1/2026 15:23, Sondre Een Kvalfoss
via QGIS-User wrote:<br>
</div>
<blockquote type="cite"
cite="mid:VE1PR04MB67333A7EDB7B42D18DEF5E0FE5A82@VE1PR04MB6733.eurprd04.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator"
content="Microsoft Word 15 (filtered medium)">
<style>@scope { @font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Aptos;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}span.EpostStil17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;}@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}div.WordSection1
{page:WordSection1;} }</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal">We have recently enabled a new Microsoft
Defender Attack Surface Reduction (ASR) rule in our
environment called
<b>"Block use of copied or impersonated system tools"</b>,
currently running in <b>
Audit mode</b>.<o:p></o:p></p>
<p class="MsoNormal">During our review of the audit logs, we
have observed events involving
<b>curl.exe</b> and the source application <b>powershell.exe</b>,
where the common factor appears to be the following QGIS
installation path:<o:p></o:p></p>
<p class="MsoNormal">C:\Program Files\QGIS 4.2.1\bin<o:p></o:p></p>
<p class="MsoNormal">Before enabling this ASR rule in <b>Block
mode</b>, we would appreciate your help in understanding
what is triggering these events and how QGIS uses these
components. Our goal is to determine whether this behavior is
expected and whether it would be appropriate to create an
exclusion for QGIS if necessary.<o:p></o:p></p>
<p class="MsoNormal">Could you please provide any details on the
processes or functionality within QGIS that may invoke
curl.exe and/or powershell.exe from this location?<o:p></o:p></p>
<p class="MsoNormal">Thank you for your assistance. Please
include me in the reply if possible.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kind regards,<o:p></o:p></p>
<p class="MsoNormal">Sondre Een Kvalfoss<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre wrap="" class="moz-quote-pre">_______________________________________________
QGIS-User mailing list
<a class="moz-txt-link-abbreviated" href="mailto:QGIS-User@lists.osgeo.org">QGIS-User@lists.osgeo.org</a>
List info: <a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-user">https://lists.osgeo.org/mailman/listinfo/qgis-user</a>
Unsubscribe: <a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-user">https://lists.osgeo.org/mailman/listinfo/qgis-user</a>
</pre>
</blockquote>
</body>
</html>