UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
Description
Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
Query · sigma
selection:
Image|endswith: /wget
CommandLine|re: https://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
CommandLine|contains: --no-check-certificate
CommandLine|endswith: .tar
filter_main_local_ips:
CommandLine|contains:
- https://10.
- https://192.168.
- https://172.16.
- https://172.17.
- https://172.18.
- https://172.19.
- https://172.20.
- https://172.21.
- https://172.22.
- https://172.23.
- https://172.24.
- https://172.25.
- https://172.26.
- https://172.27.
- https://172.28.
- https://172.29.
- https://172.30.
- https://172.31.
- https://127.
- https://169.254.
condition: selection and not 1 of filter_main_*
Known false positives
- Unknown