Linux Suspicious curl/wget Download-to-Temporary-Dir Followed by sh -c Execution

Flags curl/wget retrieving content into /tmp or /dev/shm followed by immediate sh -c execution on Linux.

FreeUnreviewedSigmahighv1

linux-suspicious-curl-wget-download-to-temporary-dir-followed-by-sh-c-execution-a2d9e2f3

title: Linux Suspicious curl/wget Download-to-Temporary-Dir Followed by sh -c Execution
id: 5c122244-9988-4ef8-add2-da74a17b4ab6
status: experimental
description: This rule flags Linux process executions where command lines include curl or wget, place the downloaded content in temporary locations such as /tmp or /dev/shm, and immediately use a shell via sh -c. This download-then-execute chaining is a common attacker technique for staging scripts and running them as part of multi-stage or file-dropping behaviors. It relies on process creation telemetry with the full command line to match the downloader, temporary directory usage, and execution context.
references:
  - https://gtfobins.github.io/gtfobins/wget/
  - https://gtfobins.github.io/gtfobins/curl/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml
author: Aayush Gupta, Huntrule Team
date: 2025-06-17
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_downloader:
    CommandLine|contains:
      - /curl
      - /wget
  selection_tmp:
    CommandLine|contains:
      - /tmp/
      - /dev/shm/
  selection_executor:
    CommandLine|contains: sh -c
  condition: all of selection_*
falsepositives:
  - System update scripts using temporary files
  - Installer scripts or automated provisioning tools
level: high
license: DRL-1.1
related:
  - id: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa
    type: derived

What it detects

This rule flags Linux process executions where command lines include curl or wget, place the downloaded content in temporary locations such as /tmp or /dev/shm, and immediately use a shell via sh -c. This download-then-execute chaining is a common attacker technique for staging scripts and running them as part of multi-stage or file-dropping behaviors. It relies on process creation telemetry with the full command line to match the downloader, temporary directory usage, and execution context.

Known false positives

System update scripts using temporary files
Installer scripts or automated provisioning tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.