Suspicious File Download From IP Via Wget.EXE - Paths

SIGMA detection rule by Nasreddine Bencherchali (Nextron Systems) · NOASSERTION

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

title: Suspicious File Download From IP Via Wget.EXE - Paths
id: 40aa399c-7b02-4715-8e5f-73572b493f33
status: test
description: Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe
references:
    - https://www.gnu.org/software/wget/manual/wget.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-02-23
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\wget.exe'
        - OriginalFileName: 'wget.exe'
    selection_ip:
        CommandLine|re: '://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
    selection_http:
        CommandLine|contains: 'http'
    selection_flag:
        - CommandLine|re: '\s-O\s'
        - CommandLine|contains: '--output-document'
    selection_paths:
        - CommandLine|contains:
              - ':\PerfLogs\'
              - ':\Temp\'
              - ':\Users\Public\'
              - ':\Windows\Help\'
              - ':\Windows\Temp\'
              - '\Temporary Internet'
        - CommandLine|contains|all:
              - ':\Users\'
              - '\Favorites\'
        - CommandLine|contains|all:
              - ':\Users\'
              - '\Favourites\'
        - CommandLine|contains|all:
              - ':\Users\'
              - '\Contacts\'
        - CommandLine|contains|all:
              - ':\Users\'
              - '\Pictures\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b2546894-5ad5-4447-b0c8-ad181ae86935

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion