Linux Process Creation: Wget Downloaded Files to /tmp

title: "Linux Process Creation: Wget Downloaded Files to /tmp"
id: f591d06b-5133-4517-aa14-a74761e75edb
status: test
description: This rule flags Linux process executions where wget is invoked from a process image ending with /wget, with command-line arguments indicating an explicit output target (either -O or --output-document). It further requires that the command line contains /tmp/, which is a common staging location for attacker-delivered files. The detection relies on process creation telemetry with access to the process image path and the full command line.
references:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /wget
  selection_output:
    - CommandLine|re: \s-O\s
    - CommandLine|contains: --output-document
  selection_path:
    CommandLine|contains: /tmp/
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cf610c15-ed71-46e1-bdf8-2bd1a99de6c4
    type: derived