URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where threat actors utilize wget tools to download and execute payloads from known malicious URLs, often indicating early-stage command-and-control or data exfiltration attempts. A SOC team should proactively hunt for this behavior in Azure Sentinel to rapidly isolate compromised endpoints before the downloaded artifacts can establish persistence or spread laterally across the network.

IOC Summary

Threat: ua-wget Total URLs: 14 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.174"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.174"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the URLhaus: ua-wget Malicious URLs detection rule:

• Automated Backup Scripts via Cron Jobs

  • Scenario: System administrators often deploy nightly backup scripts using cron on Linux servers that utilize wget to pull configuration files, database dumps, or software manifests from internal artifact repositories (e.g., Nexus, Artifactory) or cloud storage buckets. These legitimate requests mimic the traffic pattern of the malicious rule.
  • Suggested Filter: Exclude traffic originating from known backup server hostnames or IP ranges where the User-Agent string contains wget and the destination URL belongs to internal domains (e.g., .corp, .local) or trusted public artifact repositories (e.g., github.com, nexus.internal).

• CI/CD Pipeline Artifact Retrieval

  • Scenario: Continuous Integration platforms like Jenkins, GitLab CI, or Azure DevOps frequently use the wget command within build agents to download dependencies, Docker images, or release notes during the “Build” or “Deploy” stages. These automated jobs generate high-volume wget traffic that can be flagged as suspicious if the URLs are dynamic or hosted on external CDNs.
  • Suggested Filter: Create an exclusion for source IPs belonging to the CI/CD cluster (e.g., Jenkins controller nodes) and filter out requests where the destination URL matches known artifact registry patterns (e.g., *.maven.org, *.docker.io).

• Patch Management and Software Distribution

  • Scenario: Enterprise patch management tools such as SCCM (System Center Configuration Manager), Ansible, or Puppet often use wget to fetch update manifests, installer binaries, or policy definitions from the central distribution point. This is common during scheduled maintenance windows where agents pull data simultaneously.
  • **Suggested Filter