Windows Suspicious Wget.exe Downloads From IP to Common Staging Paths
Flags wget.exe on Windows downloading from an IP over HTTP and saving to common staging/user directories.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-02-23
- Updated
- 2026-07-30
What it detects
This rule identifies Windows process creation events where wget.exe is executed with a URL targeting a direct IP address and HTTP usage, along with output-related flags (e.g., -O or --output-document). It also requires the command line to write downloaded content to commonly abused or staging locations such as Temp, PerfLogs, Users Public, Windows Help/Temp, or Temporary Internet, and in some cases paths involving Favorites/Favourites, Contacts, or Pictures. This behavior can indicate an attacker using wget to fetch payloads or tools directly from infrastructure by writing them to high-risk directories. The detection relies on process creation telemetry including the executable image/name and full command line content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious Wget.exe Downloads From IP to Common Staging Paths
id: b8d08f6f-4b4d-42f1-bb63-b5394a345f12
status: test
description: This rule identifies Windows process creation events where wget.exe is executed with a URL targeting a direct IP address and HTTP usage, along with output-related flags (e.g., -O or --output-document). It also requires the command line to write downloaded content to commonly abused or staging locations such as Temp, PerfLogs, Users Public, Windows Help/Temp, or Temporary Internet, and in some cases paths involving Favorites/Favourites, Contacts, or Pictures. This behavior can indicate an attacker using wget to fetch payloads or tools directly from infrastructure by writing them to high-risk directories. The detection relies on process creation telemetry including the executable image/name and full command line content.
references:
- https://www.gnu.org/software/wget/manual/wget.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wget_download_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wget.exe
- OriginalFileName: wget.exe
selection_ip:
CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
selection_http:
CommandLine|contains: http
selection_flag:
- CommandLine|re: \s-O\s
- CommandLine|contains: --output-document
selection_paths:
- CommandLine|contains:
- :\PerfLogs\
- :\Temp\
- :\Users\Public\
- :\Windows\Help\
- :\Windows\Temp\
- \Temporary Internet
- CommandLine|contains|all:
- :\Users\
- \Favorites\
- CommandLine|contains|all:
- :\Users\
- \Favourites\
- CommandLine|contains|all:
- :\Users\
- \Contacts\
- CommandLine|contains|all:
- :\Users\
- \Pictures\
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 40aa399c-7b02-4715-8e5f-73572b493f33
type: derived