Chained shell command downloads, chmods and runs a /tmp payload

Siemphony@siemphonymediumT1659unverified

Matches a single shell invocation combining a curl/wget fetch into /tmp or /var/tmp with a chmod on the same command line — the compressed, single-event form of AN0993's "curl/wget commands saving executable/script payloads to /tmp... followed by execution," and the closest thing to an injected-content delivery observable this brief supports on Linux. The Windows leg (AN0992: browser drops a file or spawns a script host) is not authored here, because it is mechanically the same lineage already published for T1189 (browser writes executable content outside its download folder), T1203 and T1204 (client application spawns a scripting host), and repeating it would add no new coverage. This rule cannot see the network leg either — nothing in the command line distinguishes a payload that arrived because traffic was injected from one fetched from ordinary adversary infrastructure — and it needs an auditd rule arming the execve syscall (for example `-a always,exit -F arch=b64 -S execve`), absent from a default install on every mainstream distribution, or the rule returns nothing and the silence means the syscall is not being recorded. It is also blind to the same sequence run as separate commands: fetch, chmod and execution have to share one command line, so a script or automation that issues them as three process creations — the ordinary shape outside an interactive one-liner — matches nothing here, and Sigma has no construct to join those events. UNVERIFIED — derived from MITRE ATT&CK DET0349 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((((FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash") and (ProcessCommandLine contains "curl " or ProcessCommandLine contains "wget ")) and (ProcessCommandLine contains "/tmp/" or ProcessCommandLine contains "/var/tmp/")) and (ProcessCommandLine contains "chmod +x" or ProcessCommandLine contains "chmod 755" or ProcessCommandLine contains "chmod 777"))

Splunk · SPL

Run this as a search.

index=* ((((Image="*/sh" OR Image="*/bash" OR Image="*/dash") AND (CommandLine="*curl *" OR CommandLine="*wget *")) AND (CommandLine="*/tmp/*" OR CommandLine="*/var/tmp/*")) AND (CommandLine="*chmod +x*" OR CommandLine="*chmod 755*" OR CommandLine="*chmod 777*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((((TO_LOWER(process.executable) LIKE "*/sh" OR TO_LOWER(process.executable) LIKE "*/bash" OR TO_LOWER(process.executable) LIKE "*/dash") AND (TO_LOWER(process.command_line) LIKE "*curl *" OR TO_LOWER(process.command_line) LIKE "*wget *")) AND (TO_LOWER(process.command_line) LIKE "*/tmp/*" OR TO_LOWER(process.command_line) LIKE "*/var/tmp/*")) AND (TO_LOWER(process.command_line) LIKE "*chmod +x*" OR TO_LOWER(process.command_line) LIKE "*chmod 755*" OR TO_LOWER(process.command_line) LIKE "*chmod 777*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/sh$|/bash$|/dash$)</field>    <field name="CommandLine" type="pcre2">(?i)(curl |wget )</field>    <field name="CommandLine" type="pcre2">(?i)(/tmp/|/var/tmp/)</field>    <field name="CommandLine" type="pcre2">(?i)(chmod \+x|chmod 755|chmod 777)</field>    <description>Chained shell command downloads, chmods and runs a /tmp payload</description>    <mitre>      <id>T1659</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: ingress_tool_transfer
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: 91030a45-a31d-43c1-829f-4414fb96989c

ATT&CKT1659

T1659Content Injection

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoningress tool transfer

ingress tool transfer

01 · What this rule detects

An adversary moving tooling onto a host they have just reached — a transfer utility the operating system already ships opening an outbound connection, the background transfer service being handed a job from the command line, or a shell one-liner that downloads a payload, marks it executable and runs it in a single breath.

02 · Telemetry you need

Process creation with full command lines on both Windows and Linux — the download command's own text is most of the signal
Network connection events that name the initiating process (Sysmon Event ID 3 or equivalent), because the process owning the socket is what separates certutil-as-downloader from certutil validating a certificate chain
Parent process and user context, to tell an interactive administrator from a service account or a web server's child
On Linux, execve auditing that captures the full inline -c script of a shell, not just its first argument

03 · How the logic works

Three shapes, in rising order of intent. First, a known transfer utility — certutil, curl, wget, tftp, finger, ftp, ssh — initiating an outbound connection: the network-connection event is the one log source where the process and the destination arrive together. Second, the background transfer service being scripted: bitsadmin carrying /transfer, /addfile or /SetNotifyCmdLine, or the BITS PowerShell cmdlets — which both stages the payload and, through the notify command, can run it later under a service identity. Third, on Linux, the compressed stager: one shell invocation that fetches into /tmp or /var/tmp and chmods the result on the same command line, or that sleeps before piping a download straight into an interpreter. The shapes matter more than the tool names — a downloader you have never heard of still has to touch a world-writable path, mark something executable, or wire a fetch to an interpreter.

04 · Common false positives

curl.exe ships with Windows and is the default fetch in build scripts, health checks and monitoring probes — on any estate it is the highest-volume match and is not separable on the network event alone
Software distribution and patching that still stages packages with bitsadmin /transfer or Start-BitsTransfer, from a configuration-management parent on a fixed schedule
Provisioners, CI runners and container entrypoints that legitimately download a binary to /tmp, chmod +x it and execute it — the same idiom as the malicious stager, differing only in the URL and the payload
certutil retrieving a certificate revocation list or issuer certificate during ordinary chain validation

05 · Detection maturity

Tier 1 — starting point: Matches the named transfer utilities and BITS switches in command lines, fleet-wide, with no exclusions.
Tier 2 — tuned: Scopes by parent process and account, separates fixed-cadence automation from interactive use, and raises severity on fetch-and-execute one-liners into world-writable paths.
Tier 3 — correlated: Correlates the download with the file write and the subsequent execution into one incident, and enriches with whether the destination has ever been seen from that host.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Key exclusions on the parent process or service account together with the utility, never the utility alone — excluding curl outright blinds the rule to the most common ingress path
Raise severity when the same command line both fetches and executes, and when the write path is /tmp, /var/tmp or a user-writable Windows directory
Give bitsadmin /SetNotifyCmdLine its own higher-severity rule: a transfer job that runs a command afterwards is persistence wearing an ingress coat
Fixed-cadence matches are automation — baseline them by host and command line before enabling alerts, and treat a first-seen destination as worth more than a first-seen tool

Declared by the author

Configuration-management provisioners (Ansible, Chef, Puppet local-exec steps) and homegrown deployment scripts that explicitly curl or wget a binary to /tmp/, chmod +x it, then invoke it within the same shell step — a common idiom precisely because it avoids piping an installer through a live shell, and it differs from malicious use only in the URL and the payload.
CI/CD runners and container entrypoints that fetch a helper binary or build plugin into /tmp at start-up, chmod it and execute it as a routine part of an ephemeral pipeline or container boot.
An administrator pasting a vendor-provided diagnostic or hotfix one-liner by hand, run interactively as root or via sudo, that downloads to /tmp, marks it executable and runs it.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1659, evaluated against their process_creation events.

Share this rule

/u/siemphony/91030a45-a31d-43c1-829f-4414fb96989c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Chained shell command downloads, chmods and runs a /tmp payload

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it