Windows: Alert on wget.exe downloading files from an IP with output flags

title: "Windows: Alert on wget.exe downloading files from an IP with output flags"
id: 8b212921-d079-44ce-a819-f20319cb603e
status: test
description: This rule flags Windows process executions where wget.exe is invoked with a command line containing an IP-based URL and HTTP, along with common output redirection flags (e.g., -O or --output-document). It also matches when the command line ends with suspicious downloaded file extensions such as .ps1, .dat, .msi, .bat, .exe, .vbs, .vbe, .hta, .dll, or .psm1. Attackers often use wget to pull payloads or scripts directly from remote hosts, so the combination of wget, IP URL, HTTP, and an output file indicator is a strong behavioral signal. The detection relies on Windows process creation telemetry, specifically Image/OriginalFileName and CommandLine contents.
references:
  - https://www.gnu.org/software/wget/manual/wget.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wget_download_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wget.exe
    - OriginalFileName: wget.exe
  selection_ip:
    CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  selection_http:
    CommandLine|contains: http
  selection_flag:
    - CommandLine|re: \s-O\s
    - CommandLine|contains: --output-document
  selection_ext:
    CommandLine|endswith:
      - .ps1
      - .ps1'
      - .ps1"
      - .dat
      - .dat'
      - .dat"
      - .msi
      - .msi'
      - .msi"
      - .bat
      - .bat'
      - .bat"
      - .exe
      - .exe'
      - .exe"
      - .vbs
      - .vbs'
      - .vbs"
      - .vbe
      - .vbe'
      - .vbe"
      - .hta
      - .hta'
      - .hta"
      - .dll
      - .dll'
      - .dll"
      - .psm1
      - .psm1'
      - .psm1"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35
    type: derived