Redis Set Cron Wget Pipe Sh

Detects a Redis SET command that writes a cron-formatted entry (*/<n> * * * *) invoking wget -q -O- <url> | sh. This reflects Redis exploitation where an attacker implants a scheduled task that silently downloads a remote shell script and immediately pipes it into sh for execution. The -q -O- combination is characteristic of automated botnet droppers, enabling non-interactive retrieval and direct execution without writing the payload to disk first. This behavior indicates persistence establishment and remote command staging on a host with an exposed or misconfigured Redis service.