Download And Execute In One Command
A single command line fetches a file with wget, curl, tftp or ftpget and runs it: piped into a shell, made executable with chmod +x, or started with sh. This is the core of nearly every Linux botnet dropper. The honeypot blocks outbound connections, so the download fails, but the URL is logged.
Tested
Matches all 4 attack events in match.jsonl and none of the 4 look-alike events in nomatch.jsonl. See the test events.
False positives
- Install one-liners (curl ... | sh) run by administrators on real servers
Sigma
title: Download And Execute In One Command
id: 9be2e151-09ea-4bb9-a8da-686525c6de97
status: experimental
description: |
A single command line fetches a file with wget, curl, tftp or ftpget and runs it: piped into a shell,
made executable with chmod +x, or started with sh. This is the core of nearly every Linux botnet
dropper. The honeypot blocks outbound connections, so the download fails, but the URL is logged.
references:
- https://attack.mitre.org/techniques/T1105/
- https://attack.mitre.org/techniques/T1059/004/
author: Estul Lachin
date: 2026-11-08
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
- attack.t1059.004
logsource:
product: cowrie
detection:
download:
eventid: cowrie.command.input
input|re: '\b(wget|curl|tftp|ftpget)\b'
execute:
input|re: '\|\s*(ba)?sh\b|chmod\s+(\+x|[0-7]*7[0-7]*)|[;&]\s*(ba)?sh\s+\S'
condition: download and execute
falsepositives:
- Install one-liners (curl ... | sh) run by administrators on real servers
level: highSplunk SPL
``` Download And Execute In One Command. Generated from rules/download_and_execute.yml by tools/build.py; do not edit. ```
index=honeypot sourcetype=cowrie:json eventid="cowrie.command.input"
| regex input="\\b(wget|curl|tftp|ftpget)\\b"
| regex input="\\|\\s*(ba)?sh\\b|chmod\\s+(\\+x|[0-7]*7[0-7]*)|[;&]\\s*(ba)?sh\\s+\\S"Microsoft Sentinel KQL
// Download And Execute In One Command. Generated from rules/download_and_execute.yml by tools/build.py; do not edit.
Cowrie_CL
| where (eventid =~ "cowrie.command.input" and input matches regex "\\b(wget|curl|tftp|ftpget)\\b") and input matches regex "\\|\\s*(ba)?sh\\b|chmod\\s+(\\+x|[0-7]*7[0-7]*)|[;&]\\s*(ba)?sh\\s+\\S"