Curl Exfiltration via User-Agent to temp.sh

Ethan Andrews@eandrews

•updated Mar 2, 2026•15•0•261

Detects the use of curl.exe where the User-Agent string contains a URL pointing to temp.sh. This specific TTP was observed in the Notepad++ supply chain attack (Chrysalis infection chain) to exfiltrate system information and signal the uploaded file's location to the C2 server.