Hunt - Linux Exfiltrate data in a file over HTTPS using wget (T1048.002)

Danny Y@zendannyy

•updated Jun 29, 2026•1•0•4

Hunting rule loosely modeled after Atomic Red Team T1048.002 test "Exfiltrate data in a file over HTTPS using wget". No public in-the-wild intel reference available; correlate before alerting.