Batch Script Dropper Downloading Multi-Stage Malware to %TEMP% (Red Lamassu)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects the execution of known Windows download utilities (curl, wget, certutil, bitsadmin, powershell) spawned directly from cmd.exe (batch script context). The rule focuses on commands referencing temporary directories or common download/transfer parameters, which are often indicative of staged malicious activity, such as fetching secondary payloads or tools.