Windows Wget.exe Downloads From File-Sharing Domains Matching Suspicious Output Flags

title: Windows Wget.exe Downloads From File-Sharing Domains Matching Suspicious Output Flags
id: 430e0e30-4e95-476c-8d20-90e1dfa970aa
related:
  - id: 8b48ad89-10d8-4382-a546-50588c410f0d
    type: similar
  - id: d635249d-86b5-4dad-a8c7-d7272b788586
    type: similar
  - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
    type: similar
  - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
    type: similar
  - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
    type: similar
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: similar
  - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
    type: similar
  - id: b6e04788-29e1-4557-bb14-77f761848ab8
    type: similar
  - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
    type: similar
  - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
    type: derived
status: test
description: This rule identifies Windows process executions of wget.exe where the command line references common file-sharing or paste-style domains and includes HTTP plus output options. Attackers often use wget to quickly retrieve remote payloads or staging files, including executables and scripts, while writing them to disk via -O or --output-document. Detection relies on process creation telemetry, specifically the executable name and command-line substrings/regex matches for the web domain and download/output parameters.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
modified: 2026-03-29
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wget.exe
    - OriginalFileName: wget.exe
  selection_websites:
    CommandLine|contains:
      - .githubusercontent.com
      - 0x0.st
      - anonfiles.com
      - bashupload.com
      - cdn.discordapp.com
      - chunk.io
      - ddns.net
      - dl.dropboxusercontent.com
      - ghostbin.co
      - github.com
      - glitch.me
      - gofile.io
      - hastebin.com
      - mediafire.com
      - mega.nz
      - onrender.com
      - pages.dev
      - paste.ee
      - pastebin.com
      - pastebin.pl
      - pastetext.net
      - pixeldrain.com
      - privatlab.com
      - privatlab.net
      - send.exploit.in
      - sendspace.com
      - storage.googleapis.com
      - storjshare.io
      - supabase.co
      - temp.sh
      - transfer.sh
      - trycloudflare.com
      - ufile.io
      - w3spaces.com
      - workers.dev
      - x0.at
  selection_http:
    CommandLine|contains: http
  selection_flag:
    - CommandLine|re: \s-O\s
    - CommandLine|contains: --output-document
  selection_ext:
    CommandLine|endswith:
      - .ps1
      - .ps1'
      - .ps1"
      - .dat
      - .dat'
      - .dat"
      - .msi
      - .msi'
      - .msi"
      - .bat
      - .bat'
      - .bat"
      - .exe
      - .exe'
      - .exe"
      - .vbs
      - .vbs'
      - .vbs"
      - .vbe
      - .vbe'
      - .vbe"
      - .hta
      - .hta'
      - .hta"
      - .dll
      - .dll'
      - .dll"
      - .psm1
      - .psm1'
      - .psm1"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1