Curl File Upload To File Sharing Websites
Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith: '\curl.exe'
- OriginalFileName: 'curl.exe'
selection_cli_domain:
CommandLine|contains:
- '0x0.st'
- 'bashupload.com'
- 'chunk.io'
- 'file.io'
- 'filebin.net'
- 'pastebin'
- 'send.firefox.com'
- 'temp.sh'
- 'transfer.sh'
- 'ufile.io'
- 'uploadfiles.io'
- 'wetransfer.com'
- 'x0.at'
selection_cli_flags:
- CommandLine|contains:
- ' --form'
- ' --upload-file'
- ' --data'
- ' -X POST'
- ' --request POST '
- CommandLine|re:
- '\s-[FTd]\s' # We use regex to ensure a case sensitive argument detection
- '\s-sT\s'
condition: all of selection_*Legitimate file uploads to these services by administrators or developers
Tactics
Sub-techniques
Potential Data Exfiltration Via Curl.EXE
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
This rule was derived from the related rule - both detect similar activity with different scope.
Potential Data Exfiltration Activity Via CommandLine Tools
Detects the use of various CLI utilities exfiltrating data via web requests
Detects similar activity. Both rules may fire on overlapping events.