Curl to PowerShell Execution | Storm-0249 EDR Exploitation

Ramzi Zelfani@rzelfani

•updated Dec 18, 2025•42•0•340

Detects the use of curl.exe to download content from a remote source and pipe it directly into PowerShell for execution. This is a fileless execution technique used by adversaries like Storm-0249 to bypass traditional file-based defenses.