Windows: Alert on wget.exe downloading files from an IP with output flags
Flags Windows wget.exe usage to download HTTP URLs from IPs and write outputs to script/binary extensions.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-27
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions where wget.exe is invoked with a command line containing an IP-based URL and HTTP, along with common output redirection flags (e.g., -O or --output-document). It also matches when the command line ends with suspicious downloaded file extensions such as .ps1, .dat, .msi, .bat, .exe, .vbs, .vbe, .hta, .dll, or .psm1. Attackers often use wget to pull payloads or scripts directly from remote hosts, so the combination of wget, IP URL, HTTP, and an output file indicator is a strong behavioral signal. The detection relies on Windows process creation telemetry, specifically Image/OriginalFileName and CommandLine contents.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Alert on wget.exe downloading files from an IP with output flags"
id: 8b212921-d079-44ce-a819-f20319cb603e
status: test
description: This rule flags Windows process executions where wget.exe is invoked with a command line containing an IP-based URL and HTTP, along with common output redirection flags (e.g., -O or --output-document). It also matches when the command line ends with suspicious downloaded file extensions such as .ps1, .dat, .msi, .bat, .exe, .vbs, .vbe, .hta, .dll, or .psm1. Attackers often use wget to pull payloads or scripts directly from remote hosts, so the combination of wget, IP URL, HTTP, and an output file indicator is a strong behavioral signal. The detection relies on Windows process creation telemetry, specifically Image/OriginalFileName and CommandLine contents.
references:
- https://www.gnu.org/software/wget/manual/wget.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wget_download_direct_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-27
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wget.exe
- OriginalFileName: wget.exe
selection_ip:
CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
selection_http:
CommandLine|contains: http
selection_flag:
- CommandLine|re: \s-O\s
- CommandLine|contains: --output-document
selection_ext:
CommandLine|endswith:
- .ps1
- .ps1'
- .ps1"
- .dat
- .dat'
- .dat"
- .msi
- .msi'
- .msi"
- .bat
- .bat'
- .bat"
- .exe
- .exe'
- .exe"
- .vbs
- .vbs'
- .vbs"
- .vbe
- .vbe'
- .vbe"
- .hta
- .hta'
- .hta"
- .dll
- .dll'
- .dll"
- .psm1
- .psm1'
- .psm1"
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35
type: derived