UNC4841 - Download Compressed Files From Temp.sh Using Wget

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•29

Detects the execution of 'wget' to download compressed files ('.zip' or '.rar') from 'temp.sh'. This activity has been observed in attacks attributed to UNC4841, specifically during their exploitation of Barracuda ESG zero-day vulnerabilities.