Local File Read Using Curl.EXE
Detects the execution of "curl.exe" with the "file:///" protocol handler in the command line, which can be used to read local files. This technique can be leveraged by adversaries to exfiltrate or discover sensitive information from a compromised system.
Sigma
