1200KM / sigma-rule
Data Exfiltration with Wget — Sigma Rule
Sigma rule cb39d16b-b3b6-4a7a-8222-1cf24b686ffc. Data Exfiltration with Wget — Sigma Rule. Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.
Rule metadata and linked tags
Author: Pawel Mazur. Source status: test; severity: medium. Source dates: 2021-11-18 / 2022-12-25.
{
"product": "linux",
"service": "auditd"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: f0b690721afad0bec3d993b76729ec0f5e207a9ce51bcccffa40ac6ee442ad40
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Data Exfiltration with Wget
id: cb39d16b-b3b6-4a7a-8222-1cf24b686ffc
status: test
description: |
Detects attempts to post the file with the usage of wget utility.
The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.
references:
- https://linux.die.net/man/1/wget
- https://gtfobins.github.io/gtfobins/wget/
author: 'Pawel Mazur'
date: 2021-11-18
modified: 2022-12-25
tags:
- attack.exfiltration
- attack.t1048.003
logsource:
product: linux
service: auditd
detection:
selection:
type: EXECVE
a0: wget
a1|startswith: '--post-file='
condition: selection
falsepositives:
- Legitimate usage of wget utility to post a file
level: medium
False positives
- Legitimate usage of wget utility to post a file
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.