Data Exfil - Wget/Curl Direct Upload (T1041)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•3•0•10

Identifies native network tools (curl.exe, wget.exe) using HTTP PUT or POST parameters to upload local archive files (zip, rar, 7z) directly to attacker-controlled IPs.