Wget Download and Bash Execution

This analytic detects the use of `wget` to download a file from a remote source and pipe its content directly to `bash` for execution. This behavior is commonly associated with malicious activities such as deploying coinminers or exploiting vulnerabilities like CVE-2021-44228 (Log4j). Successful execution of such commands could lead to arbitrary code execution, system compromise, and unauthorized data access.

Splunk (SPL)