✄𐘗
text code block:
✄𐘗process where event.type == "start" and 
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name : ("curl", "curl.exe") and 
(
  process.args in ("-T", "--upload-file") or
  (
    (process.args in ("-F", "-d", "--form") or process.args like "--data*") and process.command_line like "*@*"
  )
) and
(
  process.command_line like ("*http:*", "*https:*", "*ftp:*", "*ftps:*") or
  process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
) and 
not process.args : ("https://*/ap/fleet/*", "https://*/api/saved_objects/*", "http*localhost:*", "http*127.0.0.*", "*ApiKey*", "http*.us-central1.run.app/*", "*Authorization*", "*session.id*", "http*.elastic-cloud.com*", "http*.elastic.dev*", "http*.elastic.cloud*", "http*.aws.found.io*", "http*.gcp.cloud.es.io*", "http*.cisco.com/api/*", "-u", "http://192.168*")