URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors utilize wget with a specific user-agent string to exfiltrate data or download payloads from known malicious URLs identified by URLhaus. A SOC team should proactively hunt for this activity in Azure Sentinel because these high-severity indicators often signal early-stage command-and-control communications that may bypass standard web proxy filters if the user-agent signature is not explicitly monitored.

IOC Summary

Threat: ua-wget Total URLs: 38 Active URLs: 0

URL	Status	Threat	Date Added
`hxxp://5.182.210.174/8d34d4`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/07c643`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/14515c`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/bb74f6`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/44973f`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/330a6e`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/c915c0`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/0dfd70`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/8c04f2`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/8bea3b`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/452bff`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/feb455`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/ae2072`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/e489b0`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/9a923d`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/455b2c`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/119bdc`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/6ccdef`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/106fe5`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/f46a9e`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/7fbafd`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/074635`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/449188`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/373541`	offline	malware_download	2026-08-22
`hxxp://5.182.210.174/889136`	offline	malware_download	2026-08-22

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.174"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.174"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario 1: Automated Patch Management via Wget
- Context: Enterprise patch management tools (e.g., WSUS, SCCM, or custom Ansible scripts) frequently use wget to download update manifests, driver packages, or security bulletins from trusted vendor repositories (e.g., Microsoft Update Content, Cisco Software Center). These downloads often trigger the rule because the User-Agent string is explicitly set to Wget/1.x.
- Filter/Exclusion: Exclude traffic where the destination IP belongs to known internal patch servers or specific trusted external domains (e.g., *.microsoft.com, *.cisco.com) AND the source process is a recognized administrative tool like sccmagent.exe or ansible-runner.py.
Scenario 2: Scheduled Data Backup and Archiving Jobs
- Context: Nightly scheduled jobs (often running via Windows Task Scheduler or Cron) utilize wget to fetch daily log files, configuration backups, or financial reports from external partners or cloud storage buckets. These legitimate transfers mimic the behavior of a malicious download script using the same User-Agent.
- Filter/Exclusion: Create an exclusion based on time-of-day (e.g., 02:00–06:00 local time) for source hosts identified as “Backup Servers” or “Data Warehouses,” specifically filtering out URLs ending in common archive extensions like .zip, .tar.gz, or .csv that do not match the specific malicious signatures in the URLhaus feed.
Scenario 3: DevOps CI/CD Pipeline Artifacts
- Context: Continuous Integration and Deployment platforms (e.g., Jenkins, GitLab CI,