Sigma high experimental sigma

Curl File Upload To File Sharing Websites

Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.

View Source

Detection Logic

{
  "selection_img": [
    {
      "Image
| endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_cli_domain": {
    "CommandLine
| contains": [
      "0x0.st",
      "bashupload.com",
      "chunk.io",
      "file.io",
      "filebin.net",
      "pastebin",
      "send.firefox.com",
      "temp.sh",
      "transfer.sh",
      "ufile.io",
      "uploadfiles.io",
      "wetransfer.com",
      "x0.at"
    ]
  },
  "selection_cli_flags": [
    {
      "CommandLine
| contains": [
        " --form",
        " --upload-file",
        " --data",
        " -X POST",
        " --request POST "
      ]
    },
    {
      "CommandLine
| re": [
        "\\s-[FTd]\\s",
        "\\s-sT\\s"
      ]
    }
  ],
  "condition": "all of selection_*"
}

False Positives

  • ⚠ Legitimate file uploads to these services by administrators or developers

Field Validations

Loading…

Comments (0)

Loading comments...