Potential Data Exfiltration Through Wget

[rule]
description = """
Detects the use of wget to upload collected data or files to an internet server from suspicious working directories,
including via HTTP POST options or use of cat/base64 on sensitive paths. Threat actors commonly collect data on a system
and exfiltrate it back to their C2 server, and wget has been observed being abused for this purpose. Use of wget in this
way, while not inherently malicious, should be considered highly abnormal and suspicious activity.
"""
id = "5389bdae-778e-48b6-af2e-0107327ca855"
license = "Elastic License v2"
name = "Potential Data Exfiltration Through Wget"
os_list = ["linux"]
reference = ["https://linux.die.net/man/1/wget"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "wget" and
process.parent.executable != null and (
  process.args like ("--post-file*", "--post-data*", "--body-file*") or
  (
    process.command_line like ("*cat*", "*base64*") and
    process.command_line like (
      "*/etc/passwd*", "*/etc/shadow*", "*~/.ssh/*", "*.env*", "*credentials*", "*/tmp/*",
      "*/var/tmp/*", "*/dev/shm/*", "*/home/*/*", "*/root/*"
    )
  )
) and
(
  process.command_line like ("*http://*", "*https://*") or
  process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
) and (
  process.working_directory like (
    "/tmp*", "/var/tmp*", "/dev/shm*", "/run*", "/var/run*", "/home/*/*", "/root*",
    "/var/www*", "/boot*", "/srv*", "/mnt*", "/media*"
  ) or
  process.parent.working_directory like (
    "/tmp*", "/var/tmp*", "/dev/shm*", "/run*", "/var/run*", "/home/*/*", "/root*",
    "/var/www*", "/boot*", "/srv*", "/mnt*", "/media*"
  )
) and
not
(
  process.command_line like (
    "*://localhost*",
    "*://127.0.0.1*",
    "*://0.0.0.0*",
    "*://[::1]*",
    "*10.*.*.*",
    "*192.168.*.*",
    "*172.16.*.*",
    "*api.telegram.org*", /* already covered by another rule */
    "*https://storage.googleapis.com/detonate-prod/*",
    "*https://storage.googleapis.com/detonate-ci/*",
    "*https://artifactory.*.local/artifactory*"
  ) or
  process.working_directory like ("/home/*/*", "/root", "/opt/ft/nl/*") or
  process.parent.executable like "/opt/miniconda/bin/python*" or
  process.parent.command_line like ("*/var/spool/asterisk/wgetstderr*", "*lastaccesseduuid*")
)
'''

min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1048"
name = "Exfiltration Over Alternative Protocol"
reference = "https://attack.mitre.org/techniques/T1048/"


[threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"

[internal]
min_endpoint_version = "8.2.0"