Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site

Alerts on Linux curl command lines using -d to send data to a specific webhook.site endpoint, consistent with exfiltration.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-09-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Collection → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
- T1041Exfiltration Over C2 Channel
Impact

What it detects

This rule flags Linux process creation events where the executed command is curl and includes data-posting arguments (-d) targeting a specific webhook.site URL. Such behavior is consistent with attackers exfiltrating collected data from a compromised environment to an external endpoint. The detection relies on process execution telemetry capturing the image path and command-line contents, including the presence of curl, -d, and the exact webhook URL.

Reporting behind it

Related detections9 linkedT1041 — drag to rearrange

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

Malicious PowerShell Exfiltration to webhook.site Following WSUS Exploitation

Suspicious InvisibleFerret C2 Endpoints over Port 1224 (via proxy)

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

Suspicious Browser and Wallet Credential Theft via JavaScript Stealer

Suspicious DEEPPOST Data Exfiltration URI Pattern via BrazenBamboo

Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site

Pivot detection · T1041 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-curl-data-exfiltration-attempt-from-npm-package-to-webhook-site-efd2eb09

title: "Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site"
id: 8908a692-7df9-4519-8ba8-e86fab3491b7
status: experimental
description: This rule flags Linux process creation events where the executed command is curl and includes data-posting arguments (-d) targeting a specific webhook.site URL. Such behavior is consistent with attackers exfiltrating collected data from a compromised environment to an external endpoint. The detection relies on process execution telemetry capturing the image path and command-line contents, including the presence of curl, -d, and the exact webhook URL.
references:
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hululd_exfiltration.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.collection
  - attack.t1005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /curl
    CommandLine|contains|all:
      - curl
      - -d
      - webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: efd2eb09-b72e-4a61-8dc7-b1382a1e8983
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL