Potemkin Loader - cURL Fetching ZIP Archive (T1105)
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with the '-o' flag to output to a .zip file from an HTTP/HTTPS URL, and then correlates this with a file creation event for a .zip file on the same device.
Microsoft Sentinel (KQL)
