Curl File Upload To File Sharing Websites
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration
Severity
Attention
Rule Requirement
Criteria
Action1:
actionname = "Process started" AND (PROCESSNAME endswith "\curl.exe" OR (ORIGINALFILENAME = "curl.exe" AND COMMANDLINE contains "0x0.st,bashupload.com,chunk.io,file.io,filebin.net,pastebin,send.firefox.com,temp.sh,transfer.sh,ufile.io,uploadfiles.io,wetransfer.com,x0.at" AND COMMANDLINE contains "--form,--upload-file,--data,-X POST,--request POST" AND COMMANDLINE contains "-F,-T,-d,-sT"))
select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME,Action1.DOMAIN,Action1.ORIGINALFILENAME,Action1.PARENTPROCESSID,Action1.PROCESSID,Action1.PRODUCT_NAME,Action1.SECURITYID
Detection
Execution Mode
continuous
Log Sources
Windows
Author
@Swachchhanda Shrawan Poudel (Nextron Systems)
