PowerShell curl download of r.zip from 103.86.86.244 Gateway path

Arnold Chan@slaz

•updated Sep 8, 2026•1•0•2

This rule detects the execution of powershell.exe with command-line arguments that utilize 'curl' to download a file from a specific remote IP address (103.86.86.244). This behavior is characteristic of adversaries using built-in Windows tools or redirected utilities to perform ingress tool transfer as part of a malicious payload delivery.