Redis Set Cron Root Http Pipe Sh

Detects a Redis SET command that implants a system-style cron entry including the root user field and a direct HTTP fetch piped into sh (e.g., cd1 -fsSL http://… | sh). This reflects Redis exploitation where an attacker establishes privileged scheduled execution for repeated remote script retrieval and execution. The inclusion of root indicates targeting of /etc/crontab-style injection, enabling execution with elevated privileges after a subsequent SAVE/BGSAVE. This is strongly associated with automated botnet propagation and host-level persistence via misconfigured or unauthenticated Redis services.