All Detections

Malicious curl Download of update_ms.msi Disguised as Windows Update

avatar
Luís Marques@remotecodeexecution
updated today000

This rule detects the Download of the stager for the msaRAT directly from the IP marked as IOC

Sigma