Windows: Detect curl.exe upload/data flags indicative of possible exfiltration
Detects curl.exe executions with upload/form/data flags on Windows that may indicate potential data exfiltration, excluding localhost targets.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) (SigmaHQ), DRL 1.1
- Published
- 2020-07-03
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation where curl.exe is executed with command-line options consistent with uploading or sending data (e.g., form/upload-file/data flags). Such behavior can be used by attackers to move data to an external location over HTTP/S. It relies on process creation telemetry with accessible process image paths and full command-line arguments, and excludes cases targeting localhost (127.0.0.1/localhost).
Reporting behind it
- twitter.comhttps://twitter.com/d1r4c/status/1279042657508081664
- medium.comhttps://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
- curl.sehttps://curl.se/docs/manpage.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_fileupload.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect curl.exe upload/data flags indicative of possible exfiltration"
id: 08052ae2-0b57-42da-bbd0-c0f803cfa130
status: test
description: This rule flags Windows process creation where curl.exe is executed with command-line options consistent with uploading or sending data (e.g., form/upload-file/data flags). Such behavior can be used by attackers to move data to an external location over HTTP/S. It relies on process creation telemetry with accessible process image paths and full command-line arguments, and excludes cases targeting localhost (127.0.0.1/localhost).
references:
- https://twitter.com/d1r4c/status/1279042657508081664
- https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
- https://curl.se/docs/manpage.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_fileupload.yml
author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update), Huntrule Team
date: 2020-07-03
modified: 2023-05-02
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1567
- attack.t1105
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \curl.exe
- Product: The curl executable
selection_cli:
- CommandLine|contains:
- " --form"
- " --upload-file "
- " --data "
- " --data-"
- CommandLine|re: \s-[FTd]\s
filter_optional_localhost:
CommandLine|contains:
- ://localhost
- ://127.0.0.1
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Scripts created by developers and admins
level: medium
license: DRL-1.1
related:
- id: 00bca14a-df4e-4649-9054-3f2aa676bc04
type: derived