First-seen curl download destinations vs 7-day baseline (tool transfer hunt)

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•1

Detects the use of the curl utility to download files from remote destinations that have not been observed in the prior 7 to 1 days, helping identify potential ingress tool transfers or anomalous data retrieval.