Linux Process: Wget Downloads .zip/.rar from temp.sh URL

Identifies Linux wget commands that download .zip or .rar archives from temp.sh.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-06-16
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process executions where wget is used to fetch compressed archives (.zip or .rar) from a URL containing "https://temp.sh/". Downloading staged archives via wget from an external script-hosted domain is a common pattern for attacker-driven payload retrieval and staging. It relies on process creation telemetry capturing the executed binary path and command-line arguments.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Hidden PowerShell Archive Extraction via ExtractToDirectory

Malicious Shell Payload Piped from curl to zsh

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)

Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)

Obfuscated File Decoding via Certutil (via process_creation)

Linux Process: Wget Downloads .zip/.rar from temp.sh URL

Pivot detection · T1140 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-wget-downloads-zip-rar-from-temp-sh-60d050c4

title: "Linux Process: Wget Downloads .zip/.rar from temp.sh URL"
id: bb64efb3-1c57-4153-8b29-58655dd36b40
status: test
description: This rule identifies Linux process executions where wget is used to fetch compressed archives (.zip or .rar) from a URL containing "https://temp.sh/". Downloading staged archives via wget from an external script-hosted domain is a common pattern for attacker-driven payload retrieval and staging. It relies on process creation telemetry capturing the executed binary path and command-line arguments.
references:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_compressed_file_tmep_sh.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.stealth
  - attack.t1140
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /wget
    CommandLine|contains: https://temp.sh/
    CommandLine|endswith:
      - .rar
      - .zip
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 60d050c4-e253-4d9a-b673-5ac100cfddfb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL