Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Potential Data Exfiltration Through Curl

Detects the use of curl to upload files to an internet server. Threat actors often will collect and exfiltrate data on a system to their C2 server for review. Many threat actors have been observed using curl to upload the collected data. Use of curl in this way, while not inherently malicious, should be considered highly abnormal and suspicious activity.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

References

Tagged by the source as

Data Source: Auditd ManagerData Source: CrowdstrikeData Source: Elastic DefendData Source: SentinelOneData Source: SysmonData Source: Windows Security Event LogsDomain: EndpointOS: LinuxOS: macOSOS: WindowsResources: Investigation GuideTactic: ExfiltrationUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.