Suspicious File Download From IP Via Wget.EXE - Paths

Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\wget.exe'
OriginalFileName: wget.exe

Stage 2: `all of selection_ip`

CommandLine|re: '://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'

Stage 3: `all of selection_http`

CommandLine|contains: http

Stage 4: `all of selection_flag`

or:
CommandLine|contains: --output-document
CommandLine|re: '\s-O\s'

Stage 5: `all of selection_paths`

or:
CommandLine|contains: ':\Users\'
CommandLine|contains: '\Contacts\'
CommandLine|contains: ':\Users\'
CommandLine|contains: '\Favorites\'
CommandLine|contains: ':\Users\'
CommandLine|contains: '\Favourites\'
CommandLine|contains: ':\Users\'
CommandLine|contains: '\Pictures\'
CommandLine|contains: ':\PerfLogs\'
CommandLine|contains: ':\Temp\'
CommandLine|contains: ':\Users\Public\'
CommandLine|contains: ':\Windows\Help\'
CommandLine|contains: ':\Windows\Temp\'
CommandLine|contains: '\Temporary Internet'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`--output-document` corpus 3 (sigma 3) `:\PerfLogs\` corpus 6 (sigma 6) `:\Temp\` corpus 14 (sigma 14) `:\Users\` corpus 6 (sigma 6) `:\Users\Public\` corpus 14 (sigma 14) `:\Windows\Help\` `:\Windows\Temp\` corpus 15 (sigma 15) `\Contacts\` corpus 6 (sigma 6) `\Favorites\` corpus 6 (sigma 6) `\Favourites\` corpus 6 (sigma 6) `\Pictures\` corpus 3 (sigma 3) `\Temporary Internet` corpus 6 (sigma 6) `http` corpus 31 (sigma 31)
`CommandLine`	regex_match	`://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}` corpus 5 (sigma 5) `\s-O\s` corpus 3 (sigma 3)
`Image`	ends_with	`\wget.exe` corpus 6 (sigma 6)
`OriginalFileName`	eq	`wget.exe` corpus 3 (sigma 3)

Suspicious File Download From IP Via Wget.EXE - Paths

Event coverage

Stages and Predicates

Stage 1: all of selection_img

Stage 2: all of selection_ip

Stage 3: all of selection_http