Windows: Flagged curl.exe Upload or Form Data Command-Line Activity

Detects curl.exe executions with upload/form/data flags on Windows that may indicate potential data exfiltration, excluding localhost targets.

FreeUnreviewedSigmamediumv1

windows-flagged-curl-exe-upload-or-form-data-command-line-activity-00bca14a

title: "Windows: Flagged curl.exe Upload or Form Data Command-Line Activity"
id: 08052ae2-0b57-42da-bbd0-c0f803cfa130
status: test
description: This rule identifies execution of curl.exe where the command line includes upload- and data-related flags, such as form submission or posting file contents and raw data. Attackers commonly use curl to transfer data to remote services, making these command-line patterns valuable for spotting potential exfiltration or data staging. It relies on Windows process creation telemetry, matching curl.exe execution and specific argument substrings/regex while excluding commands targeting localhost (127.0.0.1 or localhost).
references:
  - https://twitter.com/d1r4c/status/1279042657508081664
  - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
  - https://curl.se/docs/manpage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_fileupload.yml
author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update), Huntrule Team
date: 2020-07-03
modified: 2023-05-02
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1105
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - Product: The curl executable
  selection_cli:
    - CommandLine|contains:
        - " --form"
        - " --upload-file "
        - " --data "
        - " --data-"
    - CommandLine|re: \s-[FTd]\s
  filter_optional_localhost:
    CommandLine|contains:
      - ://localhost
      - ://127.0.0.1
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Scripts created by developers and admins
level: medium
license: DRL-1.1
related:
  - id: 00bca14a-df4e-4649-9054-3f2aa676bc04
    type: derived

What it detects

This rule identifies execution of curl.exe where the command line includes upload- and data-related flags, such as form submission or posting file contents and raw data. Attackers commonly use curl to transfer data to remote services, making these command-line patterns valuable for spotting potential exfiltration or data staging. It relies on Windows process creation telemetry, matching curl.exe execution and specific argument substrings/regex while excluding commands targeting localhost (127.0.0.1 or localhost).

Known false positives

Scripts created by developers and admins

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.