Wget connection to an external network

BIOC Informational

Wget connection to an external network

Wget is a command-line utility used to transfer data. Attackers may use wget to exfiltrate data outside your organization.

Module:: Platform Analytics
Agent event type:: Network
Category:: Exfiltration
Status:: Enabled

ATT&CK tactics: Exfiltration (TA0010)

ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)

Indicator:

Network action type = outgoing , failed AND remote ip != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* AND remote port != 53 AND 0 Process initiated by = wget

Preventable: yes