Suspicious Download and Execute Pattern via Curl/Wget

Aayush Gupta

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

2025-06-17 00:00:00

None

a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa

attack.execution attack.t1059.004 attack.t1203

Community Rule

hashdr1ft

Merge PR #5489 from @hashdr1ft - Suspicious Download and Execute Pattern via Curl/Wget

2025-06-25