Linux Syslog– Suspicious Use of curl or wget to External Domains
Detects suspicious use of curl or wget on Linux systems to download content from external domains. The detection extracts target domains from the command line arguments and filters out known legitimate destinations (e.g., GitHub, Linux package mirrors). Optionally, it enriches results with data from the ThreatIntelligenceIndicator table to highlight known malicious domains associated with malware, C2, or APT activity. This can be used to prioritize alerts or support automated scoring. The detection is based on syslog and is designed to reduce noise while preserving high-value findings.
Microsoft Sentinel (KQL)
