Telnet Sh Execute Downloaded Script

Identifies Telnet session activity where the attacker invokes sh to execute a previously downloaded shell script from the local filesystem. This commonly follows payload staging via wget, curl, tftp, or ftpget, and represents the execution phase of a botnet infection chain.