PXA Stealer - Suspicious CMD Execution via Office/Scripting with Curl Download and Cleanup
Detects the execution of 'cmd.exe' initiated by common Microsoft Office applications, scripting engines, or msiexec.exe, where the command line includes 'curl' for downloading a '.pdf' file and also attempts to delete files using 'del /s /q'. This behavior is often associated with initial access, download of malicious payloads, and cleanup activities by adversaries. The rule specifically looks for command lines that interact with 'Users\Public', 'conhost.exe', or use the '--headless' flag, which can indicate automated or background execution.
Microsoft Sentinel (KQL)
