UNC4841 - Download Compressed Files From Temp.sh Using Wget

Status: test
Severity: high
Log source: category process_creation, product linux
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1140` Deobfuscate/Decode Files or Information

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: UNC4841 - Download Compressed Files From Temp.sh Using Wget
id: 60d050c4-e253-4d9a-b673-5ac100cfddfb
status: test
description: Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
references:
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
    - attack.stealth
    - attack.t1140
    - detection.emerging-threats
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/wget'
        CommandLine|contains: 'https://temp.sh/'
        CommandLine|endswith:
            - '.rar'
            - '.zip'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '/wget'
    CommandLine|contains: 'https://temp.sh/'
    CommandLine|endswith:
        - '.rar'
        - '.zip'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`.rar` `.zip`	`field:"CommandLine" kind:ends_with`
`CommandLine`	match	`https://temp.sh/`	`field:"CommandLine" kind:match value:"https://temp.sh/"`
`Image`	ends_with	`/wget`	`field:"Image" kind:ends_with value:"/wget"`