Archive Download and Execution via Shell Chaining

How the attack works

An attacker or malicious script runs curl or wget to download an archive file (zip, tar, etc.) from a remote location. The command chains a second step with && or ; that extracts the archive using tar or unzip. A third chained step then executes a script that was just extracted. Because each step is a separate command joined by shell operators rather than a single pipe, it slips past detections tuned only for 'curl | bash' style execution.

Netzilo detection

Why it matters

If successful, this gives an attacker arbitrary code execution on the host, using their own downloaded payload rather than a locally trusted binary. That code can then persist, steal data, or move laterally, depending on what the extracted script does.

What you can do

• →Review any chained shell commands that combine a download tool with an archive extractor and a script execution step, especially from automation, CI jobs, or AI agent shells.
• →Restrict outbound network access from automation and agent environments to a known allowlist of package/dependency sources.
• →Require code review or approval for build scripts that fetch and execute external content, rather than letting them run unattended.
• →Log and alert on shell sessions where curl/wget, tar/unzip, and script execution occur in close sequence, and check the source URL and script contents against expected build dependencies.

Known benign look-alikes

• Legitimate build scripts that download and install dependencies from trusted sources
• Package managers that download and extract prebuilt binaries (e.g. GitHub Releases)

References

• https://attack.mitre.org/techniques/T1059/
• https://attack.mitre.org/techniques/T1204/
• https://arxiv.org/abs/2403.04783

Related threats