Suspicious File Download From IP Via Wget.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects suspicious file downloads directly from IP addresses using Wget.exe. This rule looks for executions of wget.exe where the command line contains an IP address, 'http', an output flag like '-O' or '--output-document', and a suspicious file extension. This behavior is often associated with adversaries transferring tools or malware onto a compromised system.