LoFP LoFP / legitimate file uploads to these services by administrators or developers

Techniques

Sample rules

Curl File Upload To File Sharing Websites

Description

Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.

Detection logic

condition: all of selection_*
selection_cli_domain:
  CommandLine|contains:
  - 0x0.st
  - bashupload.com
  - chunk.io
  - file.io
  - filebin.net
  - pastebin
  - send.firefox.com
  - temp.sh
  - transfer.sh
  - ufile.io
  - uploadfiles.io
  - wetransfer.com
  - x0.at
selection_cli_flags:
- CommandLine|contains:
  - ' --form'
  - ' --upload-file'
  - ' --data'
  - ' -X POST'
  - ' --request POST '
- CommandLine|re:
  - \s-[FTd]\s
  - \s-sT\s
selection_img:
- Image|endswith: \curl.exe
- OriginalFileName: curl.exe