URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging wget user agents to access known malicious URLs identified by URLhaus, indicating potential data exfiltration or command-and-control communication often used in initial infection stages. Proactively hunting for this behavior in Azure Sentinel is critical because automated scripts frequently use wget, making it difficult to distinguish legitimate administrative tasks from stealthy threat actor activity without specific log correlation and baseline analysis.

IOC Summary

Threat: ua-wget Total URLs: 4 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["196.251.121.142", "182.233.38.178"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["196.251.121.142", "182.233.38.178"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are five specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Automated Patch Management Scans

  • Scenario: System administrators utilize tools like WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager) to push updates. These agents often use the wget utility in background scripts to download patch metadata, release notes, or small configuration files from vendor repositories that may not yet be fully whitelisted by URLhaus but are flagged due to the generic ua-wget User-Agent string.
  • Suggested Filter: Exclude traffic originating from specific management server IP ranges (e.g., 10.x.x.x/24) or filter out URLs containing known vendor domains such as *.microsoft.com, *.update.microsoft.com, and *.sccm.local.

• CI/CD Pipeline Artifact Downloads

  • Scenario: In DevOps environments, build agents (e.g., Jenkins, GitLab CI, or Azure DevOps) execute scheduled jobs to fetch dependencies, Docker images, or release artifacts from internal artifact repositories (like Nexus or Artifactory). These pipelines frequently invoke wget with the default User-Agent to pull manifests, triggering alerts when accessing newly published URLs that haven’t been scanned by URLhaus yet.
  • Suggested Filter: Create an exclusion for source IPs belonging to the build agent subnet and filter destination domains containing internal artifact repository patterns (e.g., *.nexus.internal, *.artifactory.corp) or specific path prefixes like /api/v1/artifacts.

• Database Backup and Replication Scripts

  • Scenario: Database administrators run nightly scheduled jobs using custom Python or Bash scripts to verify backup integrity. These