File Downloaded via Curl or Wget to Hidden Directory

[rule]
description = """
This rule detects when the curl or wget command is used to download a file to a writeable hidden directory, such as
/tmp, /var/tmp, or /dev/shm. This behavior is used by threat actors to evade detection and may indicate command and
control activity.
"""
id = "dc1cee03-4923-4c6b-b00b-8a5c323bb753"
license = "Elastic License v2"
name = "File Downloaded via Curl or Wget to Hidden Directory"
os_list = ["linux"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.name == "wget" and process.args like ("-o", "--output-*") and
   process.args like ("/tmp*/.*", "/var/tmp*/.*", "/dev/shm/*", "-o-")) or
  (process.name == "curl" and process.args in ("--output", "-o") and
   process.args like ("/tmp*/.*", "/var/tmp*/.*", "/dev/shm/*"))
) and not (
  process.parent.executable in (
    "/Tools/aw_api.sh", "tools/dialyzer/run.sh", "/bin/kubectl", "/srv/kube-proxy-run", "/srv/kubelet/run",
    "/usr/bin/makepkg"
  ) or
  process.parent.executable like ("/run/containerd/*", "/tmp/.mount_vagran*/usr/bin/ruby") or
  process.parent.command_line in ("bash /usr/bin/maldet -u", "runc init") or
  process.command_line like (
    "*/tmp/.dialyzer_analysis*", "*.ansible*", "curl -s https://gist.githubusercontent.com/*bashrc_downlord",
    "*github.com/prefix-dev/pixi*", "*heroku-java-metrics-agent*"
  ) or
  process.args like (
    "https://release-registry.services.sentry.io/apps/sentry-cli/*package=sentry-cli",
    "https*github*astral-sh/rye/*",
    "https://github.com/codecrafters-io/*"
  ) or
  process.working_directory like ("/tmp/wbrashear/easybuild/*", "/var/tmp/pamac-build-*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"