AMOS - Exfiltration via Multipart Form POST (T1041)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Detects the final curl command transmitting archived credentials to a remote C2 via a multipart form-data upload, specifically looking for curl commands that use '-X POST' and '-F file=@/tmp/.*.zip' to upload a zip file from the /tmp directory.