Linux Process Creation: wget Downloads .zip/.rar From temp.sh

title: "Linux Process Creation: wget Downloads .zip/.rar From temp.sh"
id: bb64efb3-1c57-4153-8b29-58655dd36b40
status: test
description: This rule flags Linux process executions where the command line uses wget to fetch files from a temp.sh URL and the arguments end with .zip or .rar. Attackers commonly use short-lived hosting endpoints to stage compressed payloads, and downloading archives can be a precursor to execution or further persistence. The detection relies on process creation telemetry capturing the executed image path and the full command line, including the URL and file extensions.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_compressed_file_tmep_sh.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.stealth
  - attack.t1140
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /wget
    CommandLine|contains: https://temp.sh/
    CommandLine|endswith:
      - .rar
      - .zip
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 60d050c4-e253-4d9a-b673-5ac100cfddfb
    type: derived