UnregStealer - Dropper Fetching JSON Payload

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Detects curl.exe spawned by the batch dropper fetching data.json from known C2 endpoints. This rule correlates process creation events for curl.exe with network connection events to specific C2 domains (kak.is, goingg.is) when 'data.json' is present in the command line.