Curl Download of MSI Payload from Raw IP URL to ProgramData
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Microsoft Sentinel (KQL)
