Detection rules › Sigma
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Linux | Event ID 1: Process Create |
Rule body
title: UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
id: 23835beb-ec38-4e74-a5d4-b99af6684e91
status: test
description: Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
references:
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
- attack.stealth
- attack.t1140
- detection.emerging-threats
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: '/wget'
CommandLine|re: 'https://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
CommandLine|contains: '--no-check-certificate'
CommandLine|endswith: '.tar'
filter_main_local_ips:
# Note: Uncomment this filter if you want to exclude local IPs
CommandLine|contains:
- 'https://10.' # 10.0.0.0/8
- 'https://192.168.' # 192.168.0.0/16
- 'https://172.16.' # 172.16.0.0/12
- 'https://172.17.'
- 'https://172.18.'
- 'https://172.19.'
- 'https://172.20.'
- 'https://172.21.'
- 'https://172.22.'
- 'https://172.23.'
- 'https://172.24.'
- 'https://172.25.'
- 'https://172.26.'
- 'https://172.27.'
- 'https://172.28.'
- 'https://172.29.'
- 'https://172.30.'
- 'https://172.31.'
- 'https://127.' # 127.0.0.0/8
- 'https://169.254.' # 169.254.0.0/16
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
Image|endswith: '/wget'
CommandLine|re: 'https://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
CommandLine|contains: '--no-check-certificate'
CommandLine|endswith: '.tar'
Stage 2: not filter_main_local_ips
filter_main_local_ips:
CommandLine|contains:
- 'https://10.'
- 'https://192.168.'
- 'https://172.16.'
- 'https://172.17.'
- 'https://172.18.'
- 'https://172.19.'
- 'https://172.20.'
- 'https://172.21.'
- 'https://172.22.'
- 'https://172.23.'
- 'https://172.24.'
- 'https://172.25.'
- 'https://172.26.'
- 'https://172.27.'
- 'https://172.28.'
- 'https://172.29.'
- 'https://172.30.'
- 'https://172.31.'
- 'https://127.'
- 'https://169.254.'
Exclusions
The rule actively suppresses these predicates.
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | ends_with |
| field:"CommandLine" kind:ends_with value:".tar" |
CommandLine | match |
| field:"CommandLine" kind:match value:"--no-check-certificate" |
CommandLine | regex_match |
| field:"CommandLine" kind:regex_match value:"https://[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}" |
Image | ends_with |
| field:"Image" kind:ends_with value:"/wget" |