Shell Injection Env Exfiltration via Curl/Wget/Netcat Webhook - ATR-2026-01609 (77b361b1-bdea-5d13-b05a-b6be631c3b4c)
Detects shell injection payloads that chain legitimate-looking commands with data exfiltration via curl, wget, or netcat (nc) to an external webhook. The attack pattern is: run a benign command (git status, npm test, tail logs) then pipe sensitive data (environment variables, .env files, API keys) to an attacker-controlled server using curl -X POST, wget -qO-, or nc. These payloads exploit agents that execute shell commands on behalf of users without scrutinizing the full command pipeline.