Curl File Upload To File Sharing Websites

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_cli_domain": {
    "CommandLine
| contains": [
      "0x0.st",
      "bashupload.com",
      "chunk.io",
      "file.io",
      "filebin.net",
      "pastebin",
      "send.firefox.com",
      "temp.sh",
      "transfer.sh",
      "ufile.io",
      "uploadfiles.io",
      "wetransfer.com",
      "x0.at"
    ]
  },
  "selection_cli_flags": [
    {
      "CommandLine
| contains": [
        " --form",
        " --upload-file",
        " --data",
        " -X POST",
        " --request POST "
      ]
    },
    {
      "CommandLine
| re": [
        "\\s-[FTd]\\s",
        "\\s-sT\\s"
      ]
    }
  ],
  "condition": "process_creation and (all of selection_*)"
}

False Positives

• ⚠ Legitimate file uploads to these services by administrators or developers