Linux Curl Process Uploads Files via Form/Upload Flags

Alerts on Linux curl executions that include file upload or form submission flags in their command line, excluding localhost targets.

FreeUnreviewedSigmamediumv1

linux-curl-process-uploads-files-via-form-upload-flags-00b90cc1

title: Linux Curl Process Uploads Files via Form/Upload Flags
id: bf60ac88-7088-40ca-9451-46b76c2da72f
related:
  - id: 00bca14a-df4e-4649-9054-3f2aa676bc04
    type: derived
  - id: 00b90cc1-17ec-402c-96ad-3a8117d7a582
    type: derived
status: test
description: This rule flags Linux process executions where the image path ends with /curl and the command line includes upload-related curl options such as --form, --upload-file, or --data* variants. Attackers often use curl to package and transmit local files to remote endpoints, supporting data exfiltration and command-and-control traffic. The detection relies on process creation telemetry, matching the curl binary path and specific command-line argument patterns, while excluding requests targeting localhost or 127.0.0.1.
references:
  - https://twitter.com/d1r4c/status/1279042657508081664
  - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
  - https://curl.se/docs/manpage.html
  - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml
author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update), Huntrule Team
date: 2022-09-15
modified: 2023-05-02
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /curl
  selection_cli:
    - CommandLine|contains:
        - " --form"
        - " --upload-file "
        - " --data "
        - " --data-"
    - CommandLine|re: \s-[FTd]\s
  filter_optional_localhost:
    CommandLine|contains:
      - ://localhost
      - ://127.0.0.1
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Scripts created by developers and admins
level: medium
license: DRL-1.1

What it detects

This rule flags Linux process executions where the image path ends with /curl and the command line includes upload-related curl options such as --form, --upload-file, or --data* variants. Attackers often use curl to package and transmit local files to remote endpoints, supporting data exfiltration and command-and-control traffic. The detection relies on process creation telemetry, matching the curl binary path and specific command-line argument patterns, while excluding requests targeting localhost or 127.0.0.1.

Known false positives

Scripts created by developers and admins

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.