BlueMoon post-exploitation chain: chrome.exe->cmd.exe->curl.exe->msgbox.exe

Ankit Mehta@Secvyn

•updated 29 days ago•2•0•8

Detects the use of 'curl.exe' to download a file named 'msgbox.exe' to the local temporary directory, specifically when triggered by 'cmd.exe' originating from 'chrome.exe'. This pattern is indicative of a browser-based delivery mechanism initiating a secondary malicious download.