{"id":"cb39d16b-b3b6-4a7a-8222-1cf24b686ffc","title":"Data Exfiltration with Wget","description":"Detects attempts to post the file with the usage of wget utility.\nThe adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.\n","author":"Pawel Mazur","status":"test","level":"medium","date":"2021-11-18","modified":"2022-12-25","tags":["attack.exfiltration","attack.t1048.003"],"technique_ids":["T1048.003"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Legitimate usage of wget utility to post a file"],"references":["https://linux.die.net/man/1/wget","https://gtfobins.github.io/gtfobins/wget/"],"source_path":"rules/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml","source_sha256":"f0b690721afad0bec3d993b76729ec0f5e207a9ce51bcccffa40ac6ee442ad40","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Data Exfiltration with Wget\nid: cb39d16b-b3b6-4a7a-8222-1cf24b686ffc\nstatus: test\ndescription: |\n    Detects attempts to post the file with the usage of wget utility.\n    The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.\nreferences:\n    - https://linux.die.net/man/1/wget\n    - https://gtfobins.github.io/gtfobins/wget/\nauthor: 'Pawel Mazur'\ndate: 2021-11-18\nmodified: 2022-12-25\ntags:\n    - attack.exfiltration\n    - attack.t1048.003\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection:\n        type: EXECVE\n        a0: wget\n        a1|startswith: '--post-file='\n    condition: selection\nfalsepositives:\n    - Legitimate usage of wget utility to post a file\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1048.003","id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","page":"techniques/enterprise/T1048.003/"}],"data_path":"data/detection-rules/cb39d16b-b3b6-4a7a-8222-1cf24b686ffc.json","kind":"sigma"}