Cron persistence entry chaining wget/curl to shell for payload re-fetch

Ethan Andrews@eandrews

•updated Aug 17, 2026•12•0•7

This rule detects the creation or modification of cron jobs that schedule recurring tasks (every 5 or 10 minutes) designed to download remote scripts using wget or curl and pipe them directly into a shell interpreter (sh or bash) for execution. This behavior is indicative of persistent malware, such as botnets, re-fetching and executing secondary payloads.