Suspicious Download and Piping to Interpreters Pattern

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the usage of download utilities like curl or wget followed by piping the downloaded content directly into an interpreter such as Node.js, Python, Bash, PowerShell, Perl, or Ruby. This pattern is often used by attackers to download and execute malicious scripts or payloads directly in memory, bypassing traditional file-based detection mechanisms. Review thee process lineage for context to determine if the activity is legitimate or malicious.

2026-04-02 00:00:00

None

3a6d8c5e-9f2b-4c1d-a7e3-5b8f0d2c4e6a

attack.execution attack.t1059 attack.command-and-control attack.t1105

Nextron Sigma feed only (private)