Redis Set Cron Root Wget Pipe Sh

Detects a Redis SET command that implants a system-style cron entry including the root user field and a wget -q -O- <url> | sh execution chain. This reflects Redis exploitation where an attacker prepares a privileged cron-based persistence mechanism that silently retrieves a remote shell script and immediately executes it via sh. The inclusion of root indicates targeting of /etc/crontab-style injection rather than user crontab format, enabling elevated scheduled execution after a subsequent SAVE/BGSAVE. This behavior is strongly associated with automated botnet deployment and cryptomining campaigns targeting exposed Redis services.