Detection of Linux Ingress Tool Transfer via Curl and Wget

Adversaries frequently leverage legitimate Linux binaries, specifically 'curl' and 'wget', to facilitate the transfer of malicious payloads or secondary tools into a compromised environment. This technique, classified under Ingress Tool Transfer (MITRE ATT&CK T1105), allows actors to bridge the gap between initial access and follow-on malicious activity such as code execution, persistence, or data exfiltration.

Security operations teams must baseline these utilities to differentiate between routine administrative or automated system tasks and potentially malicious downloads. While these binaries are ubiquitous in Linux environments, their usage by non-privileged accounts or in unusual execution chains provides high-value signals for hunting and incident response. This detection focus is essential for identifying threats associated with supply chain compromises, botnet propagation (e.g., XorDDos), and other living-off-the-land scenarios where attackers attempt to minimize their footprint by utilizing pre-installed system tools.

Impact

Successful exploitation of ingress tool transfer allows attackers to introduce custom malware, reverse shells, or remote access trojans into a network. This can lead to full system compromise, exfiltration of sensitive organizational data, and long-term persistence. Unauthorized code execution resulting from these downloads often serves as a pivot point for lateral movement within the Linux infrastructure.

Recommendation

• Deploy process-creation monitoring to capture command-line arguments for 'curl' and 'wget' using Sysmon for Linux EventID 1 or equivalent EDR telemetry.
• Baseline common execution paths and parent processes for these utilities to establish a normal operational profile for your environment.
• Implement the provided Sigma rule in your SIEM to flag non-standard execution of file-download utilities.
• Prioritize the investigation of downloads originating from unknown or suspicious external IP addresses, especially when executed by user accounts that do not typically perform administrative tasks.