huntrule

Windows curl.exe Downloads from File-Sharing Domains with Suspicious Output Extensions

Alerts on curl.exe downloading files over HTTP from file-sharing/content hosting domains, based on process command-line and executable context.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-05
Updated
2026-07-31
AnalysisDetection
title: Windows curl.exe Downloads from File-Sharing Domains with Suspicious Output Extensions
id: d2303906-3284-4c4e-abb0-47b8c11353ea
related:
  - id: 8b48ad89-10d8-4382-a546-50588c410f0d
    type: similar
  - id: d635249d-86b5-4dad-a8c7-d7272b788586
    type: similar
  - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
    type: similar
  - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
    type: similar
  - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
    type: similar
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: similar
  - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: b6e04788-29e1-4557-bb14-77f761848ab8
    type: similar
  - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
    type: similar
  - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
    type: similar
  - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
    type: derived
status: test
description: This rule identifies Windows process executions of curl.exe where the command line references common file-sharing or paste/download hosting domains and includes HTTP usage. It further filters for curl output or remote-name flags and targets downloaded content types by matching command-line arguments that end with executable, script, DLL, and related extensions. This behavior matters because attackers often use curl to retrieve and stage payloads from public hosting services, and the rule relies on Windows process creation telemetry including the image name and full command line.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
modified: 2026-03-29
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \curl.exe
    - OriginalFileName: curl.exe
  selection_websites:
    CommandLine|contains:
      - .githubusercontent.com
      - 0x0.st
      - anonfiles.com
      - bashupload.com
      - cdn.discordapp.com
      - chunk.io
      - ddns.net
      - dl.dropboxusercontent.com
      - ghostbin.co
      - github.com
      - glitch.me
      - gofile.io
      - hastebin.com
      - mediafire.com
      - mega.nz
      - onrender.com
      - pages.dev
      - paste.ee
      - pastebin.com
      - pastebin.pl
      - pastetext.net
      - pixeldrain.com
      - privatlab.com
      - privatlab.net
      - send.exploit.in
      - sendspace.com
      - storage.googleapis.com
      - storjshare.io
      - supabase.co
      - temp.sh
      - transfer.sh
      - trycloudflare.com
      - ufile.io
      - w3spaces.com
      - workers.dev
      - x0.at
  selection_http:
    CommandLine|contains: http
  selection_flag:
    CommandLine|contains:
      - " -O"
      - --remote-name
      - --output
  selection_ext:
    CommandLine|endswith:
      - .ps1
      - .ps1'
      - .ps1"
      - .dat
      - .dat'
      - .dat"
      - .msi
      - .msi'
      - .msi"
      - .bat
      - .bat'
      - .bat"
      - .exe
      - .exe'
      - .exe"
      - .vbs
      - .vbs'
      - .vbs"
      - .vbe
      - .vbe'
      - .vbe"
      - .hta
      - .hta'
      - .hta"
      - .dll
      - .dll'
      - .dll"
      - .psm1
      - .psm1'
      - .psm1"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/info.yml
license: DRL-1.1