Amos Stealer curl HTTP exfiltration of archive files spawned by non-browser process
Detects suspicious usage of the 'curl' command-line tool to perform PUT or POST requests with binary data to specific paths, potentially indicating data exfiltration or command and control communication. The rule excludes common web browsers as initiating processes to reduce false positives.
Microsoft Sentinel (KQL)
