Data Exfiltration with Wget

Status: test
Severity: medium
Log source: product linux, service auditd
Author: Pawel Mazur
Source: github.com/SigmaHQ/sigma

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

Known false positives

Legitimate usage of wget utility to post a file

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1048.003` Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Telemetry coverage

Platform	Record / event type
Linux	auditd EXECVE record: Arguments supplied to the execve system call

Rule body

title: Data Exfiltration with Wget
id: cb39d16b-b3b6-4a7a-8222-1cf24b686ffc
status: test
description: |
    Detects attempts to post the file with the usage of wget utility.
    The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.
references:
    - https://linux.die.net/man/1/wget
    - https://gtfobins.github.io/gtfobins/wget/
author: 'Pawel Mazur'
date: 2021-11-18
modified: 2022-12-25
tags:
    - attack.exfiltration
    - attack.t1048.003
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: wget
        a1|startswith: '--post-file='
    condition: selection
falsepositives:
    - Legitimate usage of wget utility to post a file
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    type: EXECVE
    a0: wget
    a1|startswith: '--post-file='

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`a0`	eq	`wget`	`field:"a0" kind:eq value:"wget"`
`a1`	starts_with	`--post-file=`	`field:"a1" kind:starts_with value:"--post-file="`
`type`	eq	`EXECVE`	`field:"type" kind:eq value:"EXECVE"`