All Detections

IMDS credential query followed by curl upload from same host (TeamPCP stealer)

avatar
ills3c Intel&Coffee@Ills3C
updated 3 days ago000

Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.

Splunk (SPL)