Sigma rule: UNC4841 - Download Tar File From Untrusted Direct IP Via Wget

Rule

Title

UNC4841 - Download Tar File From Untrusted Direct IP Via Wget

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-06-16

File

rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_tar_files_direct_ip.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Log source

product

linux

category

process_creation

Detection

selection:
    Image|endswith: '/wget'
    CommandLine|re: 'https://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
    CommandLine|contains: '--no-check-certificate'
    CommandLine|endswith: '.tar'
filter_main_local_ips:
    # Note: Uncomment this filter if you want to exclude local IPs
    CommandLine|contains:
        - 'https://10.' # 10.0.0.0/8
        - 'https://192.168.' # 192.168.0.0/16
        - 'https://172.16.' # 172.16.0.0/12
        - 'https://172.17.'
        - 'https://172.18.'
        - 'https://172.19.'
        - 'https://172.20.'
        - 'https://172.21.'
        - 'https://172.22.'
        - 'https://172.23.'
        - 'https://172.24.'
        - 'https://172.25.'
        - 'https://172.26.'
        - 'https://172.27.'
        - 'https://172.28.'
        - 'https://172.29.'
        - 'https://172.30.'
        - 'https://172.31.'
        - 'https://127.' # 127.0.0.0/8
        - 'https://169.254.' # 169.254.0.0/16
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1140
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1140

References

• https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_tar_files_direct_ip.yml