Attackers use curl to send HTTP requests, fetch payloads and call command-and-control or staging endpoints from a compromised host. It can also retrieve scripts or configuration data during hands-on-keyboard activity. Defenders should monitor unusual outbound curl use, especially from servers that do not normally download content.
How curl turns an ordinary utility into an attack path
curl is attractive to attackers because it is already present in many environments, speaks standard HTTP, and can blend into normal administrator or application traffic. Once a host is compromised, an operator can use it to reach out to web endpoints, pull in payloads, or move from an initial foothold to the next stage without introducing a new toolchain. That makes curl useful for hands-on-keyboard activity, staging, and simple command-and-control interactions.
The key security property is not that curl is malicious, but that it is reliable, scriptable, and widely trusted. If a server is allowed to make arbitrary outbound web requests, curl becomes a convenient transport for downloading scripts, configuration, or binaries, and for posting data back to an external endpoint. That is why defenders often treat unexpected curl activity as a sign that a system is being used interactively rather than operating within its normal job function.
What attackers are actually doing with it
In practice, attackers use curl for a small set of repeatable tasks. They may fetch a second-stage payload from a staging server, retrieve a shell script, or call an endpoint that accepts commands or returns instructions. Because curl can set headers, follow redirects, submit POST bodies, and ignore certificate warnings when the operator chooses to, it is flexible enough for improvised intrusion work as well as scripted automation.
That same flexibility matters during post-compromise activity. curl can be used to test reachability, enumerate whether a host can talk to external infrastructure, and exfiltrate small amounts of data over ordinary web traffic. It is also common in living-off-the-land tradecraft because it reduces the need to drop a custom downloader immediately, lowering noise and delaying detection.
Attackers often prefer curl when they want something that works across Linux and many Unix-like environments, and when they do not need deep interaction with the host. For defenders, the important question is not whether curl was launched, but whether the request pattern matches the server’s role, change window, and approved egress destinations.
How defenders spot and contain suspicious curl activity
The strongest signal is context. A production server that rarely downloads content, suddenly making outbound requests to unfamiliar domains, is much more suspicious than a developer workstation using curl for a normal API test. The surrounding command line matters too, especially long URLs, encoded payloads, download-and-execute chains, unusual user agents, or requests that appear immediately before a new process starts.
Response should focus on both network and host evidence. Review process lineage, parent-child relationships, DNS lookups, proxy logs, and web traffic from the affected host. If curl is being used to retrieve a script or stage a payload, check whether the downloaded content was written to disk, piped directly into an interpreter, or followed by privilege escalation or persistence actions. MITRE ATT&CK is useful for mapping that sequence to credential access, lateral movement, and defense evasion patterns, while MITRE ATT&CK Enterprise Matrix helps analysts connect a single curl invocation to the broader intrusion chain.
Network defenders should also look for repeated outbound access from systems that should be tightly controlled. If the host is a server, build detections around destinations, methods, and timing, not just the presence of curl. The same request can be routine in one environment and a clear sign of compromise in another, so allowlist-based baselines and proxy telemetry are more useful than simple keyword alerts. CISA cyber threat advisories are a good reference point for the kinds of abuse patterns defenders should expect in active intrusions.
Risk and Threat Considerations
curl becomes risky when outbound web access is broader than the business need. A compromised host can use it to retrieve tooling, stage commands, or move data through channels that security teams often treat as routine. The result is a low-friction path from initial access to execution, persistence support, or exfiltration.
Failure mechanism: The attacker abuses normal HTTP client behavior on an already-compromised system, then hides malicious staging or command retrieval inside traffic that looks like ordinary web access.
Impact: That can delay detection, expand the attacker’s options for follow-on activity, and make it harder to distinguish legitimate administration from hostile use.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1105 — Ingress Tool Transfer | curl is used to fetch payloads and stage content from remote endpoints. |
| T1071 — Application Layer Protocol | curl can carry command and control over HTTP, blending into web traffic. | |
| T1059 — Command and Scripting Interpreter | curl often feeds scripts or command input into interpreters during hands-on-keyboard activity. | |
| Recommendation — Detect remote payload retrieval and alert on unexpected download activity from compromised hosts. Monitor HTTP-based outbound sessions for command-and-control patterns and unusual destinations. Correlate curl execution with script interpreters and execution chains on the host. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Unexpected outbound curl use is best controlled through egress governance and network telemetry. |
| Recommendation — Restrict and log outbound web access for servers and investigate deviations from approved paths. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | curl abuse is detected by reviewing process, proxy, DNS and host telemetry together. |
| SC-7 — Boundary Protection | Unexpected curl use exploits weak outbound filtering and permissive boundary controls. | |
| Recommendation — Correlate audit records to identify suspicious outbound web requests and staging behavior. Enforce egress controls that limit systems to approved external destinations and protocols. | ||
Practitioner Guidance
What to verify: Confirm which hosts are expected to run curl, what destinations they may reach, and whether the observed request aligns with the host’s normal role. A one-off curl command from a bastion or admin system is a different case from repeated downloads on a production server.
Decision rule: If curl is used to retrieve executable content, scripts, or instructions from an unexpected endpoint, treat that as potential compromise until you can explain the business purpose and confirm the full process tree and outbound destination.
Practitioner takeaway: curl is dangerous to defenders mainly because it is ordinary, so the real control is not blocking the binary, but detecting when a normal web client is being used to carry an abnormal intrusion workflow.