Fileless Execution via Curl to Shell
Detects the use of 'curl' to download content that is then directly piped to a shell interpreter (bash, sh, zsh). This technique is often used for fileless execution, where a malicious script is executed without being written to disk, as noted in the context of initial Miasma stages.
Microsoft Sentinel (KQL)
