Gamaredon Dead Drop Resolver via Curl and Telegram
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory. This is indicative of a Dead Drop Resolver (DDR) technique utilized by the Gamaredon group to retrieve Command and Control (C2) configuration data.
Sigma
