Redis Set Cron Http Pipe Sh

Detects a Redis SET command that implants a cron-formatted entry (*/<n> * * * *) containing a direct HTTP retrieval (curl/cd1 -fsSL style fetch) piped into sh. This pattern reflects Redis exploitation where attackers establish scheduled remote script execution without obfuscation (no base64 layer), typically for botnet enrollment or cryptominer deployment.