URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where threat actors leverage wget utilities to download and execute payloads from known malicious URLs flagged by URLhaus. Proactively hunting for these specific wget-driven downloads in Azure Sentinel is critical to intercept early-stage lateral movement or initial access attempts before they escalate into full-scale compromises.

IOC Summary

Threat: ua-wget Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.61"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.61"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the false positive scenarios and corresponding exclusion strategies for the URLhaus: ua-wget Malicious URLs detection rule:

• Automated Backup Scripts via Cron Jobs

  • Scenario: System administrators often configure cron jobs on Linux servers (e.g., Ubuntu or RHEL) to execute daily backup scripts. These scripts frequently utilize the native wget command with the default User-Agent string (Wget/1.X) to fetch configuration manifests, database dumps, or software update lists from internal repositories or public CDNs.
  • Filter/Exclusion: Create an exclusion rule that filters out traffic where the source IP belongs to known backup server subnets (e.g., 10.20.50.0/24) and the destination URL contains trusted domains like .internal, .gov, or specific artifact repositories (e.g., artifactory.internal).

• CI/CD Pipeline Artifacts Download

  • Scenario: In DevOps environments, Continuous Integration servers such as Jenkins, GitLab CI, or Azure DevOps often spin up ephemeral agents to build and deploy applications. These agents use wget (or a wrapper calling it) to download Docker images, dependency libraries, or release notes from public registries like Docker Hub or GitHub Packages during the pipeline execution phase.
  • Filter/Exclusion: Exclude traffic originating from CI/CD service accounts or specific hostnames (e.g., jenkins-agent-01, gitlab-runner) where the destination URL matches known artifact registry domains (e.g., registry.gitlab.com, hub.docker.io).

• Patch Management and Software Deployment Tools

  • Scenario: Enterprise patch management solutions like SCCM (System Center Configuration Manager), Ansible, or Puppet utilize wget in their backend agents to pull update catalogs, policy files, or software install