Chaos Ransomware - curl Staging of MSI Installer in ProgramData
Detects curl.exe writing an MSI package into the ProgramData directory. Chaos ransomware stages a trojanized installer this way, fetching update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so the traffic reads as TLS to port-based inspection. The match is on the behaviour rather than on that filename: curl is a signed in-box binary and has no legitimate reason to drop an installer package into ProgramData.
YARA-L
