UNC4841 - Wget Download of Tar from Untrusted Direct IP

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•31

Detects the execution of 'wget' to download a '.tar' file from an untrusted direct IP address, specifically when the '--no-check-certificate' flag is used. This behavior has been observed in attacks attributed to UNC4841 during their exploitation of Barracuda ESG zero-day vulnerabilities.