Suspicious Data Exfiltration with Wget (via auditd)

title: Suspicious Data Exfiltration with Wget (via auditd)
id: 1c3f8a7f-e668-50ef-9ca0-53e91e09fd10
status: stable
description: This rule detects attempts to post the file with the use of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could enable them to read files like /etc/shadow.
references:
    - https://attack.mitre.org/techniques/T1048/003/
    - https://linux.die.net/man/1/wget
    - https://gtfobins.github.io/gtfobins/wget/
author: 'Huntrule Team'
date: 2026-04-22
tags:
    - attack.exfiltration
    - attack.t1048.003
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: wget
        a1|startswith: '--post-file='
    condition: selection
falsepositives:
    - Unknown
level: medium