ARTEX Linux nc/curl C2 probe and WISP/gopher RAT download to hidden files
Detects a sequence where a remote host performs a network probe using netcat or curl with specific flags, followed shortly by downloading a known malicious RAT binary from the same remote IP address.
Microsoft Sentinel (KQL)
