UNC4841 - Download Compressed Files From Temp.sh Using Wget

testhigh
Log-Quelle: linux · process_creationAutor Nasreddine Bencherchali (Nextron Systems)Datum 2023-06-16
01

Beschreibung

Was dies ist, in Kürze.

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

02

Tags

attack.stealthattack.t1140detection.emerging-threats
03

Regelquelle (YAML)

title: UNC4841 - Download Compressed Files From Temp.sh Using Wget
id: 60d050c4-e253-4d9a-b673-5ac100cfddfb
status: test
description: Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
references:
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
    - attack.stealth
    - attack.t1140
    - detection.emerging-threats
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/wget'
        CommandLine|contains: 'https://temp.sh/'
        CommandLine|endswith:
            - '.rar'
            - '.zip'
    condition: selection
falsepositives:
    - Unknown
level: high
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.