huntrule

Suspicious Remote Script Download Piped to Shell via Wget or Curl on Linux

PremiumReviewedSigma · Medium · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-09-21
Updated
2026-09-21
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects wget or curl output piped directly into a shell interpreter on Linux, the initial execution used to deliver a coinminer after exploiting a vulnerable Tomcat server. Piping a downloaded script straight into sh runs attacker code in memory without ever writing an inspectable file to disk.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange
Malicious Shai-Hulud npm Worm Staging Script Execution on Linux
Suspicious Java Process Spawning Download or Shell Utility (Exposed JDWP Abuse)
Suspicious PostgreSQL Spawning Command Shell via COPY FROM PROGRAM (Soco404)
Suspicious Bash Reverse Shell via Dev TCP Redirection
Suspicious Linux Payload Fetch Piping curl Output Into a Shell
Possible CUPS cups-browsed Remote Code Execution via Shell Child Process
Malicious SUID Shell Execution via env on Ivanti EPMM
Malicious Cron Payload Retrieval via curl to Attacker Shell Scripts
Malicious IoT Malware Download and Execution Cradle
Suspicious Remote Script Download Piped to Shell via Wget or Curl on Linux
Pivot detection · T1059.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.