Suspicious Curl Activity to Vercel App
Detects network connections to a suspicious Vercel application URL ('vscode-ext-git.vercel.app') combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential ingress tool transfer or data exfiltration attempts.
Microsoft Sentinel (KQL)
