Suspicious Curl.EXE Download to Common Directories
Detects suspicious usage of `curl.exe` on Windows to download files into common temporary or user-controlled directories. This rule specifically looks for `curl.exe` being executed and writing its output to locations like `%appdata%`, `%public%`, `%temp%`, user desktop, or common temporary system directories, often associated with malware staging or persistence. It also identifies downloads of specific file extensions commonly used for malicious payloads.
YARA-L
