Curl File Upload To File Sharing Websites

Title: Curl File Upload To File Sharing Websites
Status: experimental
Description:Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.
References:
  -https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-29
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\curl.exe' OriginalFileName:'curl.exe'   selection_cli_domain:
    CommandLine|contains:
      -'0x0.st'
      -'bashupload.com'
      -'chunk.io'
      -'file.io'
      -'filebin.net'
      -'pastebin'
      -'send.firefox.com'
      -'temp.sh'
      -'transfer.sh'
      -'ufile.io'
      -'uploadfiles.io'
      -'wetransfer.com'
      -'x0.at'

  selection_cli_flags:
    - CommandLine|contains:
      - ' --form'
      - ' --upload-file'
      - ' --data'
      - ' -X POST'
      - ' --request POST '
    - CommandLine|re:
      - '\s-[FTd]\s'
      - '\s-sT\s'
  condition:all of selection_*
Falsepositives:
  -Legitimate file uploads to these services by administrators or developers
Level: high