Suspicious Curl and Tar Execution
Detects the usage of curl and tar commands in rapid succession to download and extract files. This behavior is characteristic of EtherRAT's Node.js staging process, which bypasses pre-installed dependencies.
Microsoft Sentinel (KQL)
