Living Off the Land: Detect the Web Shell's curl|bash Without Flagging the Admin

A process-execution audit log (/var/log/exec-audit.log) caught the aftermath of a web exploit: the web-server user uid=33(www-data) spawned a shell and piped a downloaded script straight into bash — living-off-the-land post-exploitation using legit binaries. The catch: an administrator (uid=0(root)) also ran curl ... | bash to install a package, which is legitimate. Build a detection that catches the attack but not the admin.

1. Identify the malicious execution — the www-data exec whose command line pipes the download into a shell (not the curl/bash children it spawns) — and record its PID in /root/case/mal_pid.txt.

2. Write a detector at /root/detect.sh that reads the audit log on stdin and prints the PID(s) it flags, one per line. Grading runs bash /root/detect.sh < /var/log/exec-audit.log. Grading also feeds it a second, unseen log the same way, so it must work from what it reads on stdin, not from a hardcoded file path or answer.

3. The real signal is CONTEXT: www-data should never spawn shells. Key on the USER, not just the command — a rule that flags any curl|bash will flag the admin too (a false positive). MITRE ATT&CK: T1059 (Command & Scripting Interpreter).