URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging wget utility to download and execute payloads from known malicious URLs identified by URLhaus, indicating potential initial access or command-and-control activity. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify early-stage compromises where attackers utilize standard HTTP tools to bypass traditional perimeter defenses and establish a foothold within the environment.

IOC Summary

Threat: ua-wget Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.61"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.61"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: ua-wget Malicious URLs detection rule in an enterprise environment:

• Scheduled Backup Scripts using wget

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) or custom Python/Shell scripts running on nightly cron jobs often use the command-line tool wget to fetch configuration files, license keys, or update manifests from trusted vendor portals. These requests frequently match the ua-wget signature even though the destination URLs are benign.
  • Filter/Exclusion: Exclude traffic originating from specific backup server hostnames (e.g., backup-server-01, veeam-repo) or filter out URLs ending in known vendor domains (e.g., .veeam.com, .microsoft.com) where the User-Agent contains Wget.

• CI/CD Pipeline Artifact Downloads

  • Scenario: DevOps platforms like Jenkins, GitLab CI, or Azure DevOps utilize wget within build agents to pull Docker images, JAR files, or npm packages from internal artifact repositories (e.g., Nexus, Artifactory) during the “Build” and “Deploy” stages. The high volume of these automated downloads can trigger alerts for every successful pipeline run.
  • Filter/Exclusion: Create an exclusion rule based on source IP ranges dedicated to CI/CD agents (e.g., 10.20.50.0/24) and exclude URLs containing paths like /artifacts, /maven, or /docker that are known internal repositories.

• Automated Software License Verification

  • Scenario: Enterprise software suites such as Microsoft Office 365, Adobe Creative Cloud, or antivirus engines (e.g., CrowdStrike, SentinelOne) periodically run background processes to verify license validity or check for