All Detections

Unc3753 Curl Msi Download Execution

avatar
Duo Tech@duotech
updated Jun 8, 2026208

Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.

YARA-L