Amadey StealC Payload Download from Self-Hosted GitLab Infrastructure
Detects the use of living-off-the-land binaries (LOLBins) such as PowerShell, curl, certutil, bitsadmin, or mshta to download potential secondary payloads from self-hosted GitLab instances. This behavior is indicative of the Amadey loader chain, where compromised GitLab infrastructure is used as a repository to stage and distribute StealC or other malicious payloads.
Sigma
