Detectionhightest

Suspicious File Download From IP Via Wget.EXE

Detects potentially suspicious file downloads directly from IP addresses using Wget.exe

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Thu Jul 2717f0c0a8-8bd5-4ee0-8c5f-a342c0199f35windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\wget.exe'
        - OriginalFileName: 'wget.exe'
    selection_ip:
        CommandLine|re: '://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
    selection_http:
        CommandLine|contains: 'http'
    selection_flag:
        - CommandLine|re: '\s-O\s'
        - CommandLine|contains: '--output-document'
    selection_ext:
        CommandLine|endswith:
            # Note you can transform this into a "contains" to increase coverage but you would need to take care of some FP.
            - '.ps1'
            - ".ps1'"
            - '.ps1"'
            - '.dat'
            - ".dat'"
            - '.dat"'
            - '.msi'
            - ".msi'"
            - '.msi"'
            - '.bat'
            - ".bat'"
            - '.bat"'
            - '.exe'
            - ".exe'"
            - '.exe"'
            - '.vbs'
            - ".vbs'"
            - '.vbs"'
            - '.vbe'
            - ".vbe'"
            - '.vbe"'
            - '.hta'
            - ".hta'"
            - '.hta"'
            - '.dll'
            - ".dll'"
            - '.dll"'
            - '.psm1'
            - ".psm1'"
            - '.psm1"'
    condition: all of selection_*