URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where threat actors utilize wget via user-agent strings to exfiltrate data or download payloads from a curated list of known malicious URLs. Proactive hunting for this behavior in Azure Sentinel is critical to rapidly identify and isolate compromised endpoints leveraging wget before they establish persistence or propagate lateral movement across the network.

IOC Summary

Threat: ua-wget Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.61"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.61"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ua-wget Malicious URLs rule, including tailored filters and exclusions for an enterprise environment:

• Automated Backup Scripts via Command Line

  • Scenario: System administrators or backup solutions (e.g., Veeam, Commvault) utilize wget in shell scripts to fetch daily configuration manifests, software update catalogs, or log archives from internal repositories. These requests often originate from server workstations and match the rule’s signature for ua-wget.
  • Filter/Exclusion: Create a whitelist exclusion based on specific source IP ranges (e.g., 10.20.40.x for the Backup Server subnet) or filter out URLs containing known internal domains (e.g., *.backup.internal.corp) where the User-Agent contains Wget.

• CI/CD Pipeline Artifact Retrieval

  • Scenario: DevOps platforms like Jenkins, GitLab CI, or GitHub Actions runners execute build pipelines that use wget to download dependencies, Docker images, or release notes from public registries (e.g., Maven Central, PyPI) before deployment. These automated jobs frequently trigger the detection logic during nightly builds.
  • Filter/Exclusion: Exclude traffic originating from known CI/CD runner hostnames (e.g., jenkins-runner-01, gitlab-ci-worker) or filter URLs that point to trusted artifact repositories (e.g., *.maven.org, *.docker.io) when the request source is identified as a build agent.

• Scheduled Compliance and Patching Tasks

  • Scenario: Endpoint Management tools such as Microsoft SCCM, Ivanti, or custom Ansible playbooks run scheduled tasks to pull patch metadata, compliance reports, or policy definitions from vendor portals using wget. These recurring jobs often hit external URLs