Suspicious Curl Exfiltration to temp.sh with C2 in User-Agent
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Microsoft Sentinel (KQL)
