C2 beaconing via curl.exe spawned by wscript.exe

Renata Cardoso@rcardososec

•updated Aug 10, 2026•1•0•5

Detects wscript.exe spawning curl.exe as a child process, consistent with C2 beaconing where the malware issues an HTTPS request via curl.exe that is redirected to a secondary attacker-controlled domain