Linux wget POST-file Usage Indicating Data Exfiltration

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
Impact

What it detects

This rule flags Linux processes executed as wget with the --post-file= argument, which can be used to transmit local file contents to an external endpoint. Attackers may leverage this to move sensitive data off the host, making the presence of wget with post-file parameters a useful exfiltration indicator. It relies on auditd EXECVE telemetry that captures the command name and arguments.

Reporting behind it

Related detections9 linkedT1048.003 — drag to rearrange

FTP Data Exfiltration via curl with Embedded Credentials

Suspicious Data Exfiltration via TFTP Client

Suspicious Finger Client Execution for Command and Control

Malicious dnscat2 DNS Tunneling C2 Traffic

Suspicious Data Transfer via curl to Raw IP Address

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Linux wget POST-file Usage Indicating Data Exfiltration

Pivot detection · T1048.003 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-wget-exfiltration-via-post-file-command-line-cb39d16b

title: Linux wget POST-file Usage Indicating Data Exfiltration
id: 20659a1f-d34e-4e81-818a-873206f82137
status: test
description: This rule flags Linux processes executed as wget with the --post-file= argument, which can be used to transmit local file contents to an external endpoint. Attackers may leverage this to move sensitive data off the host, making the presence of wget with post-file parameters a useful exfiltration indicator. It relies on auditd EXECVE telemetry that captures the command name and arguments.
references:
  - https://linux.die.net/man/1/wget
  - https://gtfobins.github.io/gtfobins/wget/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml
author: Pawel Mazur, Huntrule Team
date: 2021-11-18
modified: 2022-12-25
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: wget
    a1|startswith: --post-file=
  condition: selection
falsepositives:
  - Legitimate usage of wget utility to post a file
level: medium
license: DRL-1.1
related:
  - id: cb39d16b-b3b6-4a7a-8222-1cf24b686ffc
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL