Suspicious HTTP URL Invocation Patterns via Download Utilities - Linux

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious command line patterns involving download utilities like curl or wget invoking invalidly formatted HTTP protocols (e.g., 'http:/example.com' instead of 'http://example.com'). This may indicate an attempt to obfuscate the URL or bypass certain detection mechanisms while still reaching out to external servers for command and control or data exfiltration.

Internal Research

2026-03-18 00:00:00

None

88bc7c0a-b1b7-43d0-81cc-125cc84f85cb

attack.command-and-control attack.execution attack.t1105 attack.t1071.001 attack.stealth attack.t1027.010

Nextron Sigma feed only (private)