File Download Via Curl.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the use of 'curl.exe' to download files by looking for specific command-line arguments such as '-O', '--remote-name', or '--output'. This activity can indicate an adversary transferring tools or other files into a compromised environment.