WPPConnect/WhatsApp automation library download
This rule detects the use of PowerShell or common command-line network tools (curl, wget) to download or interact with files containing references to WPPConnect or WhatsApp automation JavaScript libraries. It flags activity where the parent process is a common LOLBIN (Living Off the Land Binary) or originates from suspicious locations such as user temporary directories, which is indicative of malicious automated tooling or script execution.
Microsoft Sentinel (KQL)
