Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site

Alerts on Linux curl command lines using -d to send data to a specific webhook.site endpoint, consistent with exfiltration.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-09-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Collection → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
- T1041Exfiltration Over C2 Channel
Impact

What it detects

This rule flags Linux process creation events where the executed command is curl and includes data-posting arguments (-d) targeting a specific webhook.site URL. Such behavior is consistent with attackers exfiltrating collected data from a compromised environment to an external endpoint. The detection relies on process execution telemetry capturing the image path and command-line contents, including the presence of curl, -d, and the exact webhook URL.

Reporting behind it

Related detections9 linkedT1005 — drag to rearrange

Malicious Velvet Ant Linux Backdoor and Credential Harvesting Artifacts (via file_event)

Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)

Malicious curl Exfiltration to Attacker Upload Endpoint on macOS (via process_creation)

Suspicious PAN-OS Running Config Staged as Web Content via CVE-2024-3400

Suspicious Infostealer Log Artifacts Written to Disk (via file_event)

Possible macOS TCC Bypass via mdimport Loading Custom Spotlight Importer

Suspicious sqlcipher Decryption of Signal Database by WAVESIGN (via process_creation)

Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site

Pivot detection · T1005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-curl-data-exfiltration-attempt-from-npm-package-to-webhook-site-efd2eb09

title: "Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site"
id: 8908a692-7df9-4519-8ba8-e86fab3491b7
status: experimental
description: This rule flags Linux process creation events where the executed command is curl and includes data-posting arguments (-d) targeting a specific webhook.site URL. Such behavior is consistent with attackers exfiltrating collected data from a compromised environment to an external endpoint. The detection relies on process execution telemetry capturing the image path and command-line contents, including the presence of curl, -d, and the exact webhook URL.
references:
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hululd_exfiltration.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.collection
  - attack.t1005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /curl
    CommandLine|contains|all:
      - curl
      - -d
      - webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: efd2eb09-b72e-4a61-8dc7-b1382a1e8983
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL