UNC4841 - Download Tar File From Untrusted Direct IP Via Wget — Detection Rule
Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.