Potential Data Exfiltration Via Curl.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects the execution of the 'curl.exe' process with specific flags that indicate an attempt to upload or exfiltrate data. This includes flags like '--form', '--upload-file', '--data', and variations of '--data-' (e.g., '--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), as well as shorthand flags like '-F', '-T', and '-d'. The rule filters out connections to localhost to reduce false positives.