cache_base payload download via wget, curl or node fetch fallback
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Microsoft Sentinel (KQL)
