URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging wget utility traffic to access known malicious URLs identified by URLhaus, often indicating automated command-and-control communication or initial payload retrieval. Proactively hunting for these specific UA-wget patterns in Azure Sentinel is critical to identify early-stage lateral movement or data exfiltration attempts that may evade standard web proxy signatures due to the use of common system tools.

IOC Summary

Threat: ua-wget Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.61"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.61"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ua-wget Malicious URLs rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Backup and Migration Scripts

  • Scenario: System administrators frequently utilize wget within Bash scripts to pull configuration files, backup archives (e.g., .tar.gz), or software installers from internal repositories or public CDNs. These legitimate downloads often carry the standard User-Agent: Wget/1.x header, triggering the rule when accessing known safe domains like github.com, azure.archive.org, or internal file servers.
  • Filter/Exclusion: Create a whitelist for specific source IPs (e.g., Backup Server FQDNs) and exclude URLs containing common backup extensions (.tar, .zip, .iso) accessed from these trusted hosts.

• CI/CD Pipeline Artifact Retrieval

  • Scenario: Continuous Integration platforms such as Jenkins, GitLab CI, or Azure DevOps often invoke wget during the build phase to fetch dependencies, Docker images, or release notes from external registries (e.g., maven.apache.org, docker.io). The pipeline agents running these jobs generate high-volume traffic with the ua-wget signature.
  • Filter/Exclusion: Exclude network traffic originating from the specific IP ranges of CI/CD runners and filter out URLs matching known artifact registry domains (e.g., *.maven.org, *.docker.io).

• Scheduled Compliance and Reporting Jobs

  • Scenario: Scheduled cron jobs on Linux-based compliance servers use wget to periodically fetch regulatory updates, threat intelligence feeds, or audit logs from external vendors. For instance, a nightly job might download the latest CVE list from nvd.nist.gov using wget, which mimics