Sigma rule: Curl File Upload To File Sharing Websites

Rule

Title

Curl File Upload To File Sharing Websites

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-03-29

File

rules/windows/process_creation/proc_creation_win_curl_upload_file_sharing_websites.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\curl.exe'
    - OriginalFileName: 'curl.exe'
selection_cli_domain:
    CommandLine|contains:
        - '0x0.st'
        - 'bashupload.com'
        - 'chunk.io'
        - 'file.io'
        - 'filebin.net'
        - 'pastebin'
        - 'send.firefox.com'
        - 'temp.sh'
        - 'transfer.sh'
        - 'ufile.io'
        - 'uploadfiles.io'
        - 'wetransfer.com'
        - 'x0.at'
selection_cli_flags:
    - CommandLine|contains:
          - ' --form'
          - ' --upload-file'
          - ' --data'
          - ' -X POST'
          - ' --request POST '
    - CommandLine|re:
          - '\s-[FTd]\s' # We use regex to ensure a case sensitive argument detection
          - '\s-sT\s'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate file uploads to these services by administrators or developers

Tags

• attack.exfiltration
• attack.t1567.002

MITRE ATT&CK ids this rule names

• T1567.002

Related rules

• 00bca14a-df4e-4649-9054-3f2aa676bc04 (derived)
• 7d1aaf3d-4304-425c-b7c3-162055e0b3ab (similar)

References

• https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_curl_upload_file_sharing_websites.yml