# Archive Download and Execution via Shell Chaining

- **Severity:** Critical
- **Signature ID:** `b3501634-d992-5452-a4b5-163f1502c151`
- **MITRE ATLAS:** AML.T0050 (Command and Scripting Interpreter), AML.T0011 (User Execution)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution)

## Summary

This detects a command pattern where a tool fetches a remote archive, extracts it, then immediately runs a script from inside it, all as one chained shell command. It's a way attackers get remote code execution while avoiding detections that only look for the classic 'pipe curl straight into bash' pattern.

## How the attack works

An attacker or malicious script runs curl or wget to download an archive file (zip, tar, etc.) from a remote location. The command chains a second step with && or ; that extracts the archive using tar or unzip. A third chained step then executes a script that was just extracted. Because each step is a separate command joined by shell operators rather than a single pipe, it slips past detections tuned only for 'curl | bash' style execution.

## Why it matters

If successful, this gives an attacker arbitrary code execution on the host, using their own downloaded payload rather than a locally trusted binary. That code can then persist, steal data, or move laterally, depending on what the extracted script does.

## What you can do

- Review any chained shell commands that combine a download tool with an archive extractor and a script execution step, especially from automation, CI jobs, or AI agent shells.
- Restrict outbound network access from automation and agent environments to a known allowlist of package/dependency sources.
- Require code review or approval for build scripts that fetch and execute external content, rather than letting them run unattended.
- Log and alert on shell sessions where curl/wget, tar/unzip, and script execution occur in close sequence, and check the source URL and script contents against expected build dependencies.

## Known benign look-alikes

- Legitimate build scripts that download and install dependencies from trusted sources
- Package managers that download and extract prebuilt binaries (e.g. GitHub Releases)

## References

- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1204/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/archive-download-exec