Node-RED staged dropper: wget script to /tmp/.s then sh execution
Detects shell command lines that download a script into a dot-prefixed file within the /tmp directory using curl or wget and subsequently execute it using a Unix shell (sh, bash, dash), similar to the Node-RED exec-node dropper variant.
Microsoft Sentinel (KQL)
