UnregStealer - cURL fetching from kak.is

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

This rule detects the execution of 'curl.exe' that initiates a network connection to the domain 'kak.is'. This activity is indicative of the UnregStealer malware attempting to fetch additional components or communicate with its command and control (C2) server.