File Download from or Upload to Hosting Service

process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget") and
process.command_line like~ (
  "*pastebin.*", "*ghostbin.*", "*hastebin.*", "*termbin.*", "*dpaste.*", "*controlc.*", "*0bin.net*", "*p.ip.fi*", "*sprunge.us*", "*paste.ee*",
  "*paste.ofcode.org*", "*textbin.net*", "*transfer.sh*", "*anonfiles.*", "*easyupload.io*", "*gofile.io*", "*send.cm*", "*ufile.io*",
  "*pixeldrain.com*", "*bayfiles.*", "*megaupload.*", "*mediafire.*", "*zippyshare.com*", "*dropapk.to*", "*shorturl.at*", "*tinyurl.com*",
  "*bit.ly/*", "*cutt.ly/*", "*is.gd/*", "*rebrand.ly/*", "*adf.ly/*", "*rb.gy/*", "*bashupload.com/*", "*bujang.online/*", "*paste.wakas.org*",
  "*paste.c-net.org*", "*paste.hexaspaces.com*"
) and not (
  process.parent.executable in ("/opt/aws/awsagent/bin/update", "/batch/pac.liste.categorie.sh") or
  process.parent.args == "/usr/local/gg/crowdsec-extract.sh" or
  process.parent.command_line like "*/.claude/shell-snapshots/snapshot-*"
)