Windows curl File Uploads to File Sharing Domains

title: Windows curl File Uploads to File Sharing Domains
id: e5dcf411-e207-4f23-9f3f-752de0826014
related:
  - id: 00bca14a-df4e-4649-9054-3f2aa676bc04
    type: derived
  - id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab
    type: similar
  - id: e328cc73-f92a-42fb-b3fa-7c2cffda981a
    type: derived
status: experimental
description: This rule flags Windows process executions where curl is invoked and the command line references known file sharing or upload domains. It also requires upload-style curl options such as multipart form submission, upload-file/data, or POST requests. Such activity can indicate data exfiltration or staging to public hosting services, and the rule relies on process creation telemetry containing the image path and full command line.
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
references:
  - https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_upload_file_sharing_websites.yml
date: 2026-03-29
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_cli_domain:
    CommandLine|contains:
      - 0x0.st
      - bashupload.com
      - chunk.io
      - file.io
      - filebin.net
      - pastebin
      - send.firefox.com
      - temp.sh
      - transfer.sh
      - ufile.io
      - uploadfiles.io
      - wetransfer.com
      - x0.at
  selection_cli_flags:
    - CommandLine|contains:
        - " --form"
        - " --upload-file"
        - " --data"
        - " -X POST"
        - " --request POST "
    - CommandLine|re:
        - \s-[FTd]\s
        - \s-sT\s
  condition: all of selection_*
falsepositives:
  - Legitimate file uploads to these services by administrators or developers
level: high
license: DRL-1.1