URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging wget utilities to download and execute payloads from known malicious URLs identified by URLhaus, indicating potential initial access or lateral movement activities. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify early-stage compromise attempts before they escalate into broader network infections.

IOC Summary

Threat: ua-wget Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.174"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.174"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Automated Backup Scripts via Command Line

  • Scenario: System administrators or automated backup agents (e.g., Veeam, Commvault) frequently utilize the wget utility in shell scripts to download daily configuration backups, patch manifests, or log archives from internal repositories and public update servers. These legitimate downloads often match the ua-wget signature but are benign.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from known backup server hostnames (e.g., backup-srv-01, vault-agent) or specific service accounts (e.g., svc-backup-admin). Additionally, exclude URLs containing internal domains (e.g., .internal.corp, .azure.com) where the User-Agent is strictly Wget/1.21 or similar versions used by your backup infrastructure.

• CI/CD Pipeline Artifact Retrieval

  • Scenario: DevOps pipelines running on platforms like Jenkins, GitLab CI, or Azure DevOps often trigger build agents to fetch dependencies, Docker images, or release notes using wget. These automated jobs run frequently and access public registries (e.g., Maven Central, GitHub Releases) that may be flagged by the rule due to the generic User-Agent string.
  • Filter/Exclusion: Implement a filter based on source IP ranges of your CI/CD runners (e.g., 10.20.40.0/24) and exclude traffic where the destination URL belongs to trusted artifact repositories (e.g., github.com, maven.apache.org, docker.io). You can also whitelist specific User-Agent strings that include pipeline identifiers, such as `Wget/1.21