Redis Set Cron Backup1 Base64 Bash

Detects a Redis SET command that writes a cron-formatted schedule (*/2 * * * *) into a key (e.g., backup1) containing a base64-encoded payload piped through base64 -d | bash | bash. This pattern is strongly associated with Redis exploitation where attackers abuse write access to plant cron jobs that repeatedly download and execute remote shell scripts. The decoded payload typically performs cd followed by remote script retrieval (e.g., via HTTP) and execution, establishing persistence and enabling botnet enrollment or cryptominer deployment.