Curl File Upload To File Sharing Websites — Sigma Rule

Rule metadata and linked tags

Author: Swachchhanda Shrawan Poudel (Nextron Systems). Source status: experimental; severity: high. Source dates: 2026-03-29 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: aa31fa0710c9f48a9b6e2a70344938496fc5eca582f2907d890b75c30244963b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Curl File Upload To File Sharing Websites
id: e328cc73-f92a-42fb-b3fa-7c2cffda981a
related:
    - id: 00bca14a-df4e-4649-9054-3f2aa676bc04
      type: derived
    - id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab
      type: similar
status: experimental
description: Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.
author: Swachchhanda Shrawan Poudel (Nextron Systems)
references:
    - https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/
date: 2026-03-29
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\curl.exe'
        - OriginalFileName: 'curl.exe'
    selection_cli_domain:
        CommandLine|contains:
            - '0x0.st'
            - 'bashupload.com'
            - 'chunk.io'
            - 'file.io'
            - 'filebin.net'
            - 'pastebin'
            - 'send.firefox.com'
            - 'temp.sh'
            - 'transfer.sh'
            - 'ufile.io'
            - 'uploadfiles.io'
            - 'wetransfer.com'
            - 'x0.at'
    selection_cli_flags:
        - CommandLine|contains:
              - ' --form'
              - ' --upload-file'
              - ' --data'
              - ' -X POST'
              - ' --request POST '
        - CommandLine|re:
              - '\s-[FTd]\s' # We use regex to ensure a case sensitive argument detection
              - '\s-sT\s'
    condition: all of selection_*
falsepositives:
    - Legitimate file uploads to these services by administrators or developers
level: high

Original YAML and metadata in JSON

False positives

• Legitimate file uploads to these services by administrators or developers

Source references

• https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/