Wget Creating Files in Tmp Directory — Detection Rule

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Read the full analysis on IntelFusions