Curl stage-2 payload retrieval from Contagious Interview C2

Ankit Mehta@Secvyn

•updated Sep 4, 2026•0•0•5

This rule detects the use of the curl command-line utility to communicate with a specific IP address (162.0.239.85) on port 3000, specifically targeting a path associated with 'mac' tasks. This pattern is indicative of a downloader or a staged payload retrieval from an external command-and-control server.