Detects Linux processes where curl or wget downloads data and pipes it directly to an interpreter for execution. The rule uses a sequence: a start event with a Linux process named curl or wget, a command_line containing a URL/IP and path, and a constrained argument set with a parent process that is a shell or interpreter; followed by a matching end event where an interpreter (bash, sh, python, perl, ruby, node, etc.) executes with a single argument. This pattern is a common technique to download and execute payloads, potentially enabling persistence, execution, or data exfiltration. The rule aligns with MITRE ATT&CK techniques for Execution (T1059, Unix Shell subtechnique T1059.004) and Command and Control (T1071), and it covers Defense Evasion by leveraging indirect command-line invocation patterns.