Exfiltration to Temp.sh Using Curl
Detects the use of curl.exe to upload data to the anonymous file-sharing service temp.sh. This technique has been observed being used by threat actors for reconnaissance data exfiltration, notably after gaining initial access through a compromised Notepad++ updater.
Sigma
