Suspicious File Download From File Sharing Domain Via Wget.EXE
Detects potentially suspicious file downloads from known file-sharing domains using `wget.exe`. This rule looks for `wget.exe` execution where the command line includes common file-sharing or code-hosting domains, an HTTP/HTTPS URL, and flags indicating an output file (e.g., `-O` or `--output-document`). It also specifically looks for downloads of common executable or script file extensions, such as `.exe`, `.dll`, `.ps1`, `.bat`, `.vbs`, `.hta`, and `.msi`.
Sigma
