Linux curl Data Exfiltration Attempt from NPM Package to webhook.site

title: Linux curl Data Exfiltration Attempt from NPM Package to webhook.site
id: 8908a692-7df9-4519-8ba8-e86fab3491b7
status: experimental
description: This rule flags Linux process executions of curl that include both an exfiltration-style POST payload flag ('-d') and a webhook.site destination URL. Attackers commonly use outbound webhooks to quickly exfiltrate collected data to an external endpoint disguised as normal HTTP traffic. The detection relies on process creation telemetry capturing the executable path and full command line, including the curl parameters and destination.
references:
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hululd_exfiltration.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.collection
  - attack.t1005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /curl
    CommandLine|contains|all:
      - curl
      - -d
      - webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: efd2eb09-b72e-4a61-8dc7-b1382a1e8983
    type: derived