Windows Process Creation: curl Uploads to File-Sharing Domains

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

This rule flags Windows process creation where curl is invoked and the command line references known file-sharing or upload domains. Such activity may indicate data exfiltration or staging of files through public hosting services. It relies on process creation telemetry, specifically the image path or original filename for curl and command-line content containing targeted upload domains and common curl upload-related flags.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

Rclone SMB Share Exfiltration

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

Malicious Data Exfiltration via MEGAcmd

Suspicious Command and Control via Discord or Telegram Bot API

Data Exfiltration to WebDAV Share via curl Upload

Windows Process Creation: curl Uploads to File-Sharing Domains

Pivot detection · T1567.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-curl-file-uploads-to-file-sharing-domains-e328cc73

title: "Windows Process Creation: curl Uploads to File-Sharing Domains"
id: e5dcf411-e207-4f23-9f3f-752de0826014
related:
  - id: 00bca14a-df4e-4649-9054-3f2aa676bc04
    type: derived
  - id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab
    type: similar
  - id: e328cc73-f92a-42fb-b3fa-7c2cffda981a
    type: derived
status: experimental
description: This rule flags Windows process creation where curl is invoked and the command line references known file-sharing or upload domains. Such activity may indicate data exfiltration or staging of files through public hosting services. It relies on process creation telemetry, specifically the image path or original filename for curl and command-line content containing targeted upload domains and common curl upload-related flags.
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
references:
  - https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_upload_file_sharing_websites.yml
date: 2026-03-29
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_cli_domain:
    CommandLine|contains:
      - 0x0.st
      - bashupload.com
      - chunk.io
      - file.io
      - filebin.net
      - pastebin
      - send.firefox.com
      - temp.sh
      - transfer.sh
      - ufile.io
      - uploadfiles.io
      - wetransfer.com
      - x0.at
  selection_cli_flags:
    - CommandLine|contains:
        - " --form"
        - " --upload-file"
        - " --data"
        - " -X POST"
        - " --request POST "
    - CommandLine|re:
        - \s-[FTd]\s
        - \s-sT\s
  condition: all of selection_*
falsepositives:
  - Legitimate file uploads to these services by administrators or developers
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL