Windows: Suspicious curl.exe File Downloads from File-Sharing Domains

title: "Windows: Suspicious curl.exe File Downloads from File-Sharing Domains"
id: d2303906-3284-4c4e-abb0-47b8c11353ea
related:
  - id: 8b48ad89-10d8-4382-a546-50588c410f0d
    type: similar
  - id: d635249d-86b5-4dad-a8c7-d7272b788586
    type: similar
  - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
    type: similar
  - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
    type: similar
  - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
    type: similar
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: similar
  - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: b6e04788-29e1-4557-bb14-77f761848ab8
    type: similar
  - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
    type: similar
  - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
    type: similar
  - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
    type: derived
status: test
description: This rule flags Windows process executions where curl.exe is run with command-line arguments indicating an HTTP download of files from commonly used file-sharing or content-hosting domains. It matters because attackers often use curl.exe to quickly retrieve payloads or tooling from public hosting services while blending in with normal command-line activity. The detection relies on Windows process creation telemetry, matching curl.exe in process fields and inspecting the full command line for both target domains and HTTP/output-related parameters.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
modified: 2026-03-29
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_websites:
    CommandLine|contains:
      - .githubusercontent.com
      - 0x0.st
      - anonfiles.com
      - bashupload.com
      - cdn.discordapp.com
      - chunk.io
      - ddns.net
      - dl.dropboxusercontent.com
      - ghostbin.co
      - github.com
      - glitch.me
      - gofile.io
      - hastebin.com
      - mediafire.com
      - mega.nz
      - onrender.com
      - pages.dev
      - paste.ee
      - pastebin.com
      - pastebin.pl
      - pastetext.net
      - pixeldrain.com
      - privatlab.com
      - privatlab.net
      - send.exploit.in
      - sendspace.com
      - storage.googleapis.com
      - storjshare.io
      - supabase.co
      - temp.sh
      - transfer.sh
      - trycloudflare.com
      - ufile.io
      - w3spaces.com
      - workers.dev
      - x0.at
  selection_http:
    CommandLine|contains: http
  selection_flag:
    CommandLine|contains:
      - " -O"
      - --remote-name
      - --output
  selection_ext:
    CommandLine|endswith:
      - .ps1
      - .ps1'
      - .ps1"
      - .dat
      - .dat'
      - .dat"
      - .msi
      - .msi'
      - .msi"
      - .bat
      - .bat'
      - .bat"
      - .exe
      - .exe'
      - .exe"
      - .vbs
      - .vbs'
      - .vbs"
      - .vbe
      - .vbe'
      - .vbe"
      - .hta
      - .hta'
      - .hta"
      - .dll
      - .dll'
      - .dll"
      - .psm1
      - .psm1'
      - .psm1"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/info.yml
license: DRL-1.1