Linux wget Exfiltration via --post-file Command-Line

Alerts on Linux wget commands using --post-file= to upload local files, indicating potential data exfiltration.

FreeUnreviewedSigmamediumv1

linux-wget-exfiltration-via-post-file-command-line-cb39d16b

title: Linux wget Exfiltration via --post-file Command-Line
id: 20659a1f-d34e-4e81-818a-873206f82137
status: test
description: This rule flags Linux process executions where wget is invoked with the --post-file= option. Attackers can use wget to transmit local files to a remote endpoint, enabling data exfiltration over HTTP(S). The detection relies on auditd EXECVE telemetry capturing the executed command name and its arguments.
references:
  - https://linux.die.net/man/1/wget
  - https://gtfobins.github.io/gtfobins/wget/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml
author: Pawel Mazur, Huntrule Team
date: 2021-11-18
modified: 2022-12-25
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: wget
    a1|startswith: --post-file=
  condition: selection
falsepositives:
  - Legitimate usage of wget utility to post a file
level: medium
license: DRL-1.1
related:
  - id: cb39d16b-b3b6-4a7a-8222-1cf24b686ffc
    type: derived

What it detects

This rule flags Linux process executions where wget is invoked with the --post-file= option. Attackers can use wget to transmit local files to a remote endpoint, enabling data exfiltration over HTTP(S). The detection relies on auditd EXECVE telemetry capturing the executed command name and its arguments.

Known false positives

Legitimate usage of wget utility to post a file

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.