Potemkin Loader - cURL Fetching ZIP Archive
Detects the use of the native Windows curl.exe utility to download a .zip file from an external URL, followed by the creation of that file on the disk. This pattern is associated with the Potemkin Loader which uses this technique to fetch RMM components, effectively bypassing PowerShell-based detection mechanisms for file downloads.
Microsoft Sentinel (KQL)
