Suspicious File Download via Command Line Utilities

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•2•0•3

This rule detects the use of common command-line utilities such as curl, certutil, and PowerShell to download files from a specific external domain ('thomphon.com') or to download a file named 'update.msi'. These activities are often associated with the staging of malicious payloads.