Anomalous curl Exfiltration to sendit.sh

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•10

Detects data exfiltration attempts using curl.exe to the public file transfer service sendit.sh. This rule specifically looks for the execution of 'curl.exe' with 'sendit.sh' in its command line arguments, indicating a potential attempt to upload or transfer data to this service.