Shell one-liner encodes data and pipes it to a network transfer tool

Siemphony@siemphonymediumT1132unverifiedPlaybook · Defence evasion

Matches AN0303's Linux observable: a single shell invocation that both names a binary-to-text or compression encoder and a network transfer tool, which is how a piped one-liner (`... | base64 | curl -d @- http://...`) actually surfaces on the process_creation category — auditd's own type=EXECVE record carries only one program's argv, so this rule matches the interpreter's own record, written when a caller passes the whole pipeline as a single string to `sh -c`/`bash -c`, as cron, a downloader stage, a configuration-management task or a webshell all commonly do. It cannot see the equivalent typed interactively at a live shell, or run from a script file invoked by path, where the encoder and the transfer tool are separate child processes with no shared field to join across. Prerequisite: auditd ships no execve rule by default, so without an explicit -a always,exit -F arch=b64 -S execve there is no process_creation telemetry on the host at all and this rule returns zero rows regardless of what ran — the silence means the syscall is not being recorded, not that the host is quiet. This is deliberately distinct from the technique's Windows sub-techniques T1132.001 and T1132.002, both scoped to PowerShell Script Block Logging and 4104 events that do not exist on Linux, and from T1048.001's openssl/gpg selectors, which match encryption keywords rather than encoding-and-transfer in one line. Of AN0303's two knobs, UserContext is the usable one here — scoping out build and orchestration service accounts is the tuning that removes most of the noise below — while TimeWindow assumes the encode and the transfer arrive as two correlatable events, which is exactly what this rule collapses into a single record and therefore cannot apply. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0108, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Shell one-liner encodes data and pipes it to a network transfer tool2id: ae1169e5-82cb-4aef-b6c6-e1aaaff773f13status: experimental4description: |5  Matches AN0303's Linux observable: a single shell invocation that both names a6  binary-to-text or compression encoder and a network transfer tool, which is how7  a piped one-liner (`... | base64 | curl -d @- http://...`) actually surfaces on8  the process_creation category — auditd's own type=EXECVE record carries only9  one program's argv, so this rule matches the interpreter's own record, written10  when a caller passes the whole pipeline as a single string to `sh -c`/`bash -c`,11  as cron, a downloader stage, a configuration-management task or a webshell all12  commonly do. It cannot see the equivalent typed interactively at a live shell,13  or run from a script file invoked by path, where the encoder and the transfer14  tool are separate child processes with no shared field to join across.15  Prerequisite: auditd ships no execve rule by default, so without an explicit16  -a always,exit -F arch=b64 -S execve there is no process_creation telemetry on17  the host at all and this rule returns zero rows regardless of what ran — the18  silence means the syscall is not being recorded, not that the host is quiet.19  This is deliberately distinct from the technique's Windows sub-techniques20  T1132.001 and T1132.002, both scoped to PowerShell Script Block Logging and21  4104 events that do not exist on Linux, and from T1048.001's openssl/gpg22  selectors, which match encryption keywords rather than encoding-and-transfer in23  one line. Of AN0303's two knobs, UserContext is the usable one here — scoping24  out build and orchestration service accounts is the tuning that removes most of25  the noise below — while TimeWindow assumes the encode and the transfer arrive26  as two correlatable events, which is exactly what this rule collapses into a27  single record and therefore cannot apply.28  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0108, not hand-written and not tested by its author. Any lab result is on this rule's own page.29references:30  - https://attack.mitre.org/techniques/T113231  - https://attack.mitre.org/detectionstrategies/DET010832author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)33date: 2026-08-1634tags:35  - attack.command-and-control36  - attack.t113237logsource:38  category: process_creation39  product: linux40detection:41  selection_shell:42    Image|endswith:43      - '/bash'44      - '/sh'45      - '/dash'46  selection_encode:47    CommandLine|contains:48      - 'base64'49      - 'gzip'50      - 'xxd'51      - 'uuencode'52      - 'b64encode'53  selection_transfer:54    CommandLine|contains:55      - 'curl'56      - 'wget'57      - 'netcat'58      - ' nc '59  condition: selection_shell and selection_encode and selection_transfer60falsepositives:61  - "CI/CD build and deployment one-liners that base64- or gzip-encode an artifact and curl it to an internal registry or API — this is a routine pattern in container build scripts and deploy hooks and is the single largest source of noise in build infrastructure."62  - "Configuration-management and orchestration tooling — Ansible, SaltStack, Chef — which runs provisioning tasks as sh -c \"<whole line>\" as its normal mechanism, the exact invocation shape this rule keys on. Any task that both encodes something and curls or wgets it matches identically to a build one-liner."63  - "Shell installer scripts that fetch a payload with curl or wget and pipe it through base64 --decode before unpacking it, when the whole pipeline is passed as one sh -c or bash -c argument (a Dockerfile RUN step, a cron line, a CM shell task). The direction is inbound, not exfiltration, but the vocabulary is identical."64  - "Diagnostic and support-bundle scripts that gzip a log collection and upload it with curl or wget to a vendor endpoint, again only where the collection and upload share one sh -c line rather than living in a script file the agent invokes by path."65level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "/bash" or FolderPath endswith "/sh" or FolderPath endswith "/dash") and (ProcessCommandLine contains "base64" or ProcessCommandLine contains "gzip" or ProcessCommandLine contains "xxd" or ProcessCommandLine contains "uuencode" or ProcessCommandLine contains "b64encode")) and (ProcessCommandLine contains "curl" or ProcessCommandLine contains "wget" or ProcessCommandLine contains "netcat" or ProcessCommandLine contains " nc "))

Splunk · SPL

Run this as a search.

index=* (((Image="*/bash" OR Image="*/sh" OR Image="*/dash") AND (CommandLine="*base64*" OR CommandLine="*gzip*" OR CommandLine="*xxd*" OR CommandLine="*uuencode*" OR CommandLine="*b64encode*")) AND (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*netcat*" OR CommandLine="* nc *"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*/bash" OR TO_LOWER(process.executable) LIKE "*/sh" OR TO_LOWER(process.executable) LIKE "*/dash") AND (TO_LOWER(process.command_line) LIKE "*base64*" OR TO_LOWER(process.command_line) LIKE "*gzip*" OR TO_LOWER(process.command_line) LIKE "*xxd*" OR TO_LOWER(process.command_line) LIKE "*uuencode*" OR TO_LOWER(process.command_line) LIKE "*b64encode*")) AND (TO_LOWER(process.command_line) LIKE "*curl*" OR TO_LOWER(process.command_line) LIKE "*wget*" OR TO_LOWER(process.command_line) LIKE "*netcat*" OR TO_LOWER(process.command_line) LIKE "* nc *"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/bash$|/sh$|/dash$)</field>    <field name="CommandLine" type="pcre2">(?i)(base64|gzip|xxd|uuencode|b64encode)</field>    <field name="CommandLine" type="pcre2">(?i)(curl|wget|netcat| nc )</field>    <description>Shell one-liner encodes data and pipes it to a network transfer tool</description>    <mitre>      <id>T1132</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ae1169e5-82cb-4aef-b6c6-e1aaaff773f1

ATT&CKT1132

T1132Data Encoding

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1132, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add additional encoding commands to the selection_encode list to increase detection coverage
Exclude specific shell scripts or commands that are known to be legitimate and cause false positives
Add a filter to exclude events where the CommandLine field contains specific keywords or phrases that are commonly used in legitimate scripts
Consider adding a threshold or aggregation to reduce noise and only alert on repeated or suspicious activity

Declared by the author

CI/CD build and deployment one-liners that base64- or gzip-encode an artifact and curl it to an internal registry or API — this is a routine pattern in container build scripts and deploy hooks and is the single largest source of noise in build infrastructure.
Configuration-management and orchestration tooling — Ansible, SaltStack, Chef — which runs provisioning tasks as sh -c "<whole line>" as its normal mechanism, the exact invocation shape this rule keys on. Any task that both encodes something and curls or wgets it matches identically to a build one-liner.
Shell installer scripts that fetch a payload with curl or wget and pipe it through base64 --decode before unpacking it, when the whole pipeline is passed as one sh -c or bash -c argument (a Dockerfile RUN step, a cron line, a CM shell task). The direction is inbound, not exfiltration, but the vocabulary is identical.
Diagnostic and support-bundle scripts that gzip a log collection and upload it with curl or wget to a vendor endpoint, again only where the collection and upload share one sh -c line rather than living in a script file the agent invokes by path.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the use of a shell one-liner that encodes data and pipes it to a network transfer tool, which is a common technique used by attackers to exfiltrate data or establish command and control channels. The rule looks for the combination of a shell process, encoding commands, and network transfer tools in the command line, which separates it from normal shell activity.

02 · Telemetry you need

Log source: process_creation events from Linux systems
Specific fields: Image, CommandLine
Audit setting: Ensure that process creation events are being logged and collected from Linux systems, which may require additional configuration

03 · How the logic works

The rule selects events where the Image field ends with a shell executable (bash, sh, or dash), and the CommandLine field contains encoding commands (base64, gzip, xxd, uuencode, or b64encode) and network transfer tools (curl, wget, netcat, or nc). The condition requires all three selections to be true, meaning that the event must involve a shell process, encoding, and network transfer.

04 · Common false positives

Backup and archiving tools that use shell scripts and encoding commands to transfer data
Automated software update tools that use curl or wget to download updates
System administration scripts that use netcat or nc for network testing or troubleshooting
Legitimate use of encoding commands for data compression or encryption

05 · Detection maturity

tier_1: The rule as written provides basic detection capabilities, but may generate false positives and requires tuning to be effective.
tier_2: With additional tuning and filtering, the rule can be made more accurate and reliable, reducing noise and improving detection of obfuscated payloads.
tier_3: Correlating this rule with other signals, such as network traffic analysis or endpoint detection, can provide a more comprehensive view of potential threats and improve the overall maturity of the detection capability.

Related detections1 nearby

Shell one-liner delays before piping a download into an interpreter

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/ae1169e5-82cb-4aef-b6c6-e1aaaff773f1

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shell one-liner encodes data and pipes it to a network transfer tool

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it