Windows Suspicious Wget.exe Downloads From IP to Common Staging Paths

title: Windows Suspicious Wget.exe Downloads From IP to Common Staging Paths
id: b8d08f6f-4b4d-42f1-bb63-b5394a345f12
status: test
description: This rule identifies Windows process creation events where wget.exe is executed with a URL targeting a direct IP address and HTTP usage, along with output-related flags (e.g., -O or --output-document). It also requires the command line to write downloaded content to commonly abused or staging locations such as Temp, PerfLogs, Users Public, Windows Help/Temp, or Temporary Internet, and in some cases paths involving Favorites/Favourites, Contacts, or Pictures. This behavior can indicate an attacker using wget to fetch payloads or tools directly from infrastructure by writing them to high-risk directories. The detection relies on process creation telemetry including the executable image/name and full command line content.
references:
  - https://www.gnu.org/software/wget/manual/wget.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wget_download_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wget.exe
    - OriginalFileName: wget.exe
  selection_ip:
    CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
  selection_http:
    CommandLine|contains: http
  selection_flag:
    - CommandLine|re: \s-O\s
    - CommandLine|contains: --output-document
  selection_paths:
    - CommandLine|contains:
        - :\PerfLogs\
        - :\Temp\
        - :\Users\Public\
        - :\Windows\Help\
        - :\Windows\Temp\
        - \Temporary Internet
    - CommandLine|contains|all:
        - :\Users\
        - \Favorites\
    - CommandLine|contains|all:
        - :\Users\
        - \Favourites\
    - CommandLine|contains|all:
        - :\Users\
        - \Contacts\
    - CommandLine|contains|all:
        - :\Users\
        - \Pictures\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 40aa399c-7b02-4715-8e5f-73572b493f33
    type: derived