Suspicious Google Drive Download to Windows Temp Via Curl

Bryant Smith@flowstate

•updated Apr 10, 2026•12•0•769

Detects the use of curl to download files from Google Drive directly into the C:\Windows\Temp directory. This behavior was observed in an in-memory loader attack chain deploying ScreenConnect.