Suspicious Curl.EXE Download to Sensitive Locations
Detects suspicious usage of curl.exe to download files to sensitive or temporary locations on Windows systems. This rule specifically looks for curl.exe processes that output downloaded content to common temporary directories, user-specific application data folders, public user folders, or the desktop, often with suspicious file extensions. This behavior is frequently associated with malware staging or initial access techniques.
Sigma
