Data Exfiltration via curl PUT (Amos Stealer)

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•4•0•14

This rule detects the use of 'curl' to perform HTTP PUT requests with binary data, a technique often employed by malware like Amos Stealer for data exfiltration. It specifically looks for command-line arguments '-X', 'PUT', and '--data-binary' in 'curl' process executions.