Suspicious Curl Payload Download To ProgramData

Luís Marques@remotecodeexecution

•updated Jul 6, 2026•1•0•2

Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory. This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).