Sapphire Sleet - Curl Post of Host Data (T1041)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•6

Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.