Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution

Flags curl/wget retrieving content into /tmp or /dev/shm followed by immediate sh -c execution on Linux.

FreeReviewedSigma · High · v3

Product: linux
Category: process_creation
Author: Aayush Gupta (SigmaHQ), DRL 1.1
Published: 2025-06-17
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process creation where command lines include curl or wget, download content to temporary locations (/tmp or /dev/shm), and immediately invoke shell execution via "sh -c". This download-and-immediate-execute pattern is a common staging technique used to run remote payloads with minimal user interaction. It relies on process creation telemetry that provides the full CommandLine for matching curl/wget, temporary directory paths, and the subsequent shell command invocation.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Malicious Foomatic-Rip Filter Spawning Shell via CUPS Exploitation

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

Malicious Download Piped to Shell via curl or wget (via process_creation)

Suspicious GobRAT Bulbature Infection Shell Scripts Execution

Suspicious Base64 Decoded Payload Piped to Shell on Linux

Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)

Suspicious OpenClaw Skill File Modification via File Event

Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution

Pivot detection · T1059.004 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-suspicious-curl-wget-download-to-temporary-dir-followed-by-sh-c-execution-a2d9e2f3

title: "Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution"
id: 5c122244-9988-4ef8-add2-da74a17b4ab6
status: experimental
description: This rule identifies Linux process creation where command lines include curl or wget, download content to temporary locations (/tmp or /dev/shm), and immediately invoke shell execution via "sh -c". This download-and-immediate-execute pattern is a common staging technique used to run remote payloads with minimal user interaction. It relies on process creation telemetry that provides the full CommandLine for matching curl/wget, temporary directory paths, and the subsequent shell command invocation.
references:
  - https://gtfobins.github.io/gtfobins/wget/
  - https://gtfobins.github.io/gtfobins/curl/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml
author: Aayush Gupta, Huntrule Team
date: 2025-06-17
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_downloader:
    CommandLine|contains:
      - /curl
      - /wget
  selection_tmp:
    CommandLine|contains:
      - /tmp/
      - /dev/shm/
  selection_executor:
    CommandLine|contains: sh -c
  condition: all of selection_*
falsepositives:
  - System update scripts using temporary files
  - Installer scripts or automated provisioning tools
level: high
license: DRL-1.1
related:
  - id: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL