Windows curl.exe Downloads from File-Sharing Domains with Suspicious Output Extensions
Alerts on curl.exe downloading files over HTTP from file-sharing/content hosting domains, based on process command-line and executable context.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-05
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process executions of curl.exe where the command line references common file-sharing or paste/download hosting domains and includes HTTP usage. It further filters for curl output or remote-name flags and targets downloaded content types by matching command-line arguments that end with executable, script, DLL, and related extensions. This behavior matters because attackers often use curl to retrieve and stage payloads from public hosting services, and the rule relies on Windows process creation telemetry including the image name and full command line.
Reporting behind it
- labs.withsecure.comhttps://labs.withsecure.com/publications/fin7-target-veeam-servers
- github.comhttps://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-curl-exe-file-downloads-from-file-sharing-domains-56454143
title: Windows curl.exe Downloads from File-Sharing Domains with Suspicious Output Extensions
id: d2303906-3284-4c4e-abb0-47b8c11353ea
related:
- id: 8b48ad89-10d8-4382-a546-50588c410f0d
type: similar
- id: d635249d-86b5-4dad-a8c7-d7272b788586
type: similar
- id: 52182dfb-afb7-41db-b4bc-5336cb29b464
type: similar
- id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
type: similar
- id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
type: similar
- id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
type: similar
- id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
type: similar
- id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
type: similar
- id: b6e04788-29e1-4557-bb14-77f761848ab8
type: similar
- id: a0d7e4d2-bede-4141-8896-bc6e237e977c
type: similar
- id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
type: similar
- id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
type: derived
status: test
description: This rule identifies Windows process executions of curl.exe where the command line references common file-sharing or paste/download hosting domains and includes HTTP usage. It further filters for curl output or remote-name flags and targets downloaded content types by matching command-line arguments that end with executable, script, DLL, and related extensions. This behavior matters because attackers often use curl to retrieve and stage payloads from public hosting services, and the rule relies on Windows process creation telemetry including the image name and full command line.
references:
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
modified: 2026-03-29
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe
selection_websites:
CommandLine|contains:
- .githubusercontent.com
- 0x0.st
- anonfiles.com
- bashupload.com
- cdn.discordapp.com
- chunk.io
- ddns.net
- dl.dropboxusercontent.com
- ghostbin.co
- github.com
- glitch.me
- gofile.io
- hastebin.com
- mediafire.com
- mega.nz
- onrender.com
- pages.dev
- paste.ee
- pastebin.com
- pastebin.pl
- pastetext.net
- pixeldrain.com
- privatlab.com
- privatlab.net
- send.exploit.in
- sendspace.com
- storage.googleapis.com
- storjshare.io
- supabase.co
- temp.sh
- transfer.sh
- trycloudflare.com
- ufile.io
- w3spaces.com
- workers.dev
- x0.at
selection_http:
CommandLine|contains: http
selection_flag:
CommandLine|contains:
- " -O"
- --remote-name
- --output
selection_ext:
CommandLine|endswith:
- .ps1
- .ps1'
- .ps1"
- .dat
- .dat'
- .dat"
- .msi
- .msi'
- .msi"
- .bat
- .bat'
- .bat"
- .exe
- .exe'
- .exe"
- .vbs
- .vbs'
- .vbs"
- .vbe
- .vbe'
- .vbe"
- .hta
- .hta'
- .hta"
- .dll
- .dll'
- .dll"
- .psm1
- .psm1'
- .psm1"
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/info.yml
license: DRL-1.1