Suspicious curl Silent Download Payload (Amos Stealer)

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•0•0•9

Detects the execution of 'curl' with specific flags ('-kfsSL') often used for silent and insecure file downloads. This pattern has been observed in malware like Amos Stealer to download malicious payloads. The rule looks for 'curl' as the filename or at the beginning of the command line, combined with the specified flags and an HTTP/HTTPS URL.