Windows: curl.exe Local File Read via file:/// Command Line
Flags curl.exe runs that include file:/// to access local files on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-27
- Updated
- 2026-07-31
What it detects
This rule flags process creation of curl.exe on Windows when the command line contains the file:/// protocol handler, indicating an attempt to read local files through curl. Attackers can use this pattern to exfiltrate or stage data by accessing local paths with standard tooling. It relies on process creation telemetry, specifically the executable name matching curl.exe and the presence of file:/// in the command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-curl-exe-reading-local-files-via-file-uri-aa6f6ea6
title: "Windows: curl.exe Local File Read via file:/// Command Line"
id: c62d6255-6332-4f93-b709-d301c8508fcd
status: test
description: This rule flags process creation of curl.exe on Windows when the command line contains the file:/// protocol handler, indicating an attempt to read local files through curl. Attackers can use this pattern to exfiltrate or stage data by accessing local paths with standard tooling. It relies on process creation telemetry, specifically the executable name matching curl.exe and the presence of file:/// in the command line.
references:
- https://curl.se/docs/manpage.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_local_file_read.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_cli:
CommandLine|contains: file:///
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/info.yml
license: DRL-1.1
related:
- id: aa6f6ea6-0676-40dd-b510-6e46f02d8867
type: derived