Linux: Suspicious curl upload via form or data flags
Alerts on Linux curl executions that include file upload or form submission flags in their command line, excluding localhost targets.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) (SigmaHQ), DRL 1.1
- Published
- 2022-09-15
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Linux processes where an executable path ending in '/curl' is started with command-line arguments consistent with uploading file content using curl form or data options (e.g., --form, --upload-file, --data*). Such behavior matters because attackers can use native curl to exfiltrate files or stage communications by embedding file data in HTTP requests. The detection relies on process creation telemetry, specifically the image path suffix and the presence of targeted command-line flags while excluding requests to localhost/127.0.0.1.
Reporting behind it
- twitter.comhttps://twitter.com/d1r4c/status/1279042657508081664
- medium.comhttps://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
- curl.sehttps://curl.se/docs/manpage.html
- trendmicro.comhttps://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Suspicious curl upload via form or data flags"
id: bf60ac88-7088-40ca-9451-46b76c2da72f
related:
- id: 00bca14a-df4e-4649-9054-3f2aa676bc04
type: derived
- id: 00b90cc1-17ec-402c-96ad-3a8117d7a582
type: derived
status: test
description: This rule identifies Linux processes where an executable path ending in '/curl' is started with command-line arguments consistent with uploading file content using curl form or data options (e.g., --form, --upload-file, --data*). Such behavior matters because attackers can use native curl to exfiltrate files or stage communications by embedding file data in HTTP requests. The detection relies on process creation telemetry, specifically the image path suffix and the presence of targeted command-line flags while excluding requests to localhost/127.0.0.1.
references:
- https://twitter.com/d1r4c/status/1279042657508081664
- https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
- https://curl.se/docs/manpage.html
- https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml
author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update), Huntrule Team
date: 2022-09-15
modified: 2023-05-02
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1567
- attack.t1105
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /curl
selection_cli:
- CommandLine|contains:
- " --form"
- " --upload-file "
- " --data "
- " --data-"
- CommandLine|re: \s-[FTd]\s
filter_optional_localhost:
CommandLine|contains:
- ://localhost
- ://127.0.0.1
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Scripts created by developers and admins
level: medium
license: DRL-1.1