Potemkin Loader - cURL Downloading ZIP Archive
Detects the use of the native Windows curl.exe utility to download a ZIP archive from a remote location, a technique used by the Potemkin Loader to retrieve malicious RMM components while avoiding PowerShell-based security controls.
Microsoft Sentinel (KQL)
