Data Exfiltration via Wget or Curl Direct Upload

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•7

This rule detects the use of native network utilities (wget.exe, curl.exe) executing with flags indicative of file uploads (HTTP PUT or POST) targeting archive files (zip, rar, 7z). This behavior is often associated with the direct exfiltration of staged data to attacker-controlled infrastructure.