Dohdoor Campaign PowerShell Uses Curl

Daniel Jeremiah@daniyyell

•updated Feb 26, 2026•0•26

Detects PowerShell executing curl.exe to download a batch script (.bat or .cmd), consistent with the Dohdoor multi stage chain described by Cisco Talos.