Linux Shell Pipe to Shell — Detection Rule

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

Read the full analysis on IntelFusions