Windows Wget.exe Downloads From File-Sharing Domains Matching Suspicious Output Flags
Flags wget.exe executions on Windows that download via HTTP from known file-sharing domains and write specific file extensions to disk.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-05
- Updated
- 2026-07-30
What it detects
This rule identifies Windows process executions of wget.exe where the command line references common file-sharing or paste-style domains and includes HTTP plus output options. Attackers often use wget to quickly retrieve remote payloads or staging files, including executables and scripts, while writing them to disk via -O or --output-document. Detection relies on process creation telemetry, specifically the executable name and command-line substrings/regex matches for the web domain and download/output parameters.
Reporting behind it
- labs.withsecure.comhttps://labs.withsecure.com/publications/fin7-target-veeam-servers
- github.comhttps://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-wget-exe-downloads-from-file-sharing-domains-matching-suspicious-output--a0d7e4d2
title: Windows Wget.exe Downloads From File-Sharing Domains Matching Suspicious Output Flags
id: 430e0e30-4e95-476c-8d20-90e1dfa970aa
related:
- id: 8b48ad89-10d8-4382-a546-50588c410f0d
type: similar
- id: d635249d-86b5-4dad-a8c7-d7272b788586
type: similar
- id: 52182dfb-afb7-41db-b4bc-5336cb29b464
type: similar
- id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
type: similar
- id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
type: similar
- id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
type: similar
- id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
type: similar
- id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
type: similar
- id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
type: similar
- id: b6e04788-29e1-4557-bb14-77f761848ab8
type: similar
- id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
type: similar
- id: a0d7e4d2-bede-4141-8896-bc6e237e977c
type: derived
status: test
description: This rule identifies Windows process executions of wget.exe where the command line references common file-sharing or paste-style domains and includes HTTP plus output options. Attackers often use wget to quickly retrieve remote payloads or staging files, including executables and scripts, while writing them to disk via -O or --output-document. Detection relies on process creation telemetry, specifically the executable name and command-line substrings/regex matches for the web domain and download/output parameters.
references:
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
modified: 2026-03-29
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wget.exe
- OriginalFileName: wget.exe
selection_websites:
CommandLine|contains:
- .githubusercontent.com
- 0x0.st
- anonfiles.com
- bashupload.com
- cdn.discordapp.com
- chunk.io
- ddns.net
- dl.dropboxusercontent.com
- ghostbin.co
- github.com
- glitch.me
- gofile.io
- hastebin.com
- mediafire.com
- mega.nz
- onrender.com
- pages.dev
- paste.ee
- pastebin.com
- pastebin.pl
- pastetext.net
- pixeldrain.com
- privatlab.com
- privatlab.net
- send.exploit.in
- sendspace.com
- storage.googleapis.com
- storjshare.io
- supabase.co
- temp.sh
- transfer.sh
- trycloudflare.com
- ufile.io
- w3spaces.com
- workers.dev
- x0.at
selection_http:
CommandLine|contains: http
selection_flag:
- CommandLine|re: \s-O\s
- CommandLine|contains: --output-document
selection_ext:
CommandLine|endswith:
- .ps1
- .ps1'
- .ps1"
- .dat
- .dat'
- .dat"
- .msi
- .msi'
- .msi"
- .bat
- .bat'
- .bat"
- .exe
- .exe'
- .exe"
- .vbs
- .vbs'
- .vbs"
- .vbe
- .vbe'
- .vbe"
- .hta
- .hta'
- .hta"
- .dll
- .dll'
- .dll"
- .psm1
- .psm1'
- .psm1"
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1