PUP Fangs - Encrypted Payload Download (T1105)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Identifies the fake updater process making network connections to download heavily encrypted payload blobs (often .bin or .dat files) to evade perimeter AV. This rule specifically looks for `curl.exe`, `powershell.exe`, or `certutil.exe` being used to download files with `.bin`, `.dat`, or `.enc` extensions, initiated by a process with 'setup' or 'update' in its filename.