curl.exe LOLBin Payload Download via Suspicious Parent Process

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects instances of curl.exe being executed by suspicious parent processes (such as shells, scripting engines, or Office applications) while using command-line arguments to download files from remote URLs to sensitive or common directory paths. This behavior is indicative of a living-off-the-land (LOLBin) attack pattern used to stage malicious payloads.