Suspicious File Download From IP Via Wget.EXE To Suspicious Paths

SigmaHQ Detections@sigmaHQ

•updated Jan 6, 2025•0•14

Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe. This rule looks for executions of 'wget.exe' where the command line includes an IP address, 'http', and specific suspicious paths often used for temporary files or public user directories. This could indicate an adversary downloading malicious tools or files directly to a system.