Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution

Flags curl/wget retrieving content into /tmp or /dev/shm followed by immediate sh -c execution on Linux.

FreeReviewedSigma · High · v3

Product: linux
Category: process_creation
Author: Aayush Gupta (SigmaHQ), DRL 1.1
Published: 2025-06-17
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process creation where command lines include curl or wget, download content to temporary locations (/tmp or /dev/shm), and immediately invoke shell execution via "sh -c". This download-and-immediate-execute pattern is a common staging technique used to run remote payloads with minimal user interaction. It relies on process creation telemetry that provides the full CommandLine for matching curl/wget, temporary directory paths, and the subsequent shell command invocation.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

Suspicious Bad Apples Reverse Shell via socat pty

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Shell Payload Piped from curl to zsh

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

Suspicious Shell Spawned by PostgreSQL Server Process (via process_creation)

Malicious Remote Script Piped Directly to a Shell (via process_creation)

Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution

Pivot detection · T1059.004 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-suspicious-curl-wget-download-to-temporary-dir-followed-by-sh-c-execution-a2d9e2f3

title: "Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution"
id: 5c122244-9988-4ef8-add2-da74a17b4ab6
status: experimental
description: This rule identifies Linux process creation where command lines include curl or wget, download content to temporary locations (/tmp or /dev/shm), and immediately invoke shell execution via "sh -c". This download-and-immediate-execute pattern is a common staging technique used to run remote payloads with minimal user interaction. It relies on process creation telemetry that provides the full CommandLine for matching curl/wget, temporary directory paths, and the subsequent shell command invocation.
references:
  - https://gtfobins.github.io/gtfobins/wget/
  - https://gtfobins.github.io/gtfobins/curl/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml
author: Aayush Gupta, Huntrule Team
date: 2025-06-17
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_downloader:
    CommandLine|contains:
      - /curl
      - /wget
  selection_tmp:
    CommandLine|contains:
      - /tmp/
      - /dev/shm/
  selection_executor:
    CommandLine|contains: sh -c
  condition: all of selection_*
falsepositives:
  - System update scripts using temporary files
  - Installer scripts or automated provisioning tools
level: high
license: DRL-1.1
related:
  - id: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL