Wget Download to Suspicious Temporary Directory
This rule detects the use of the `wget` command-line utility to download files into potentially suspicious directories, specifically `/tmp/`. Adversaries often use `wget` for ingress tool transfer, downloading malicious payloads or additional tools to a compromised system. The rule looks for `wget` execution combined with the `-O` or `--output-document` flags, which specify an output file, and the presence of `/tmp/` in the command line, indicating a download to a common temporary directory often abused by attackers.
Sigma
