Recon Exfiltration via Curl to Temp.sh

J S@jsh0x

•updated Feb 2, 2026•36•1•22,292

Detects the use of curl.exe to upload data to the temp.sh file-sharing service. This technique has been observed in post-compromise reconnaissance activities, including those following Notepad++ compromises.