Suspicious File Download From File Sharing Domain Via Curl.EXE

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•2•0•26

Detects the use of curl.exe to download files from known file-sharing or code-hosting domains. This activity is often associated with adversaries staging or retrieving malicious tools and scripts. The rule specifically looks for curl.exe executing with command-line arguments indicating a download operation ('-O', '--remote-name', '--output') from a list of suspicious domains, and targeting common executable or script file extensions.