URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging wget to access known malicious URLs, a behavior often indicative of initial command-and-control communication or lateral movement within Azure environments. Proactively hunting for these specific URLhaus-tagged interactions in Azure Sentinel is critical because wget-based traffic can easily bypass standard web proxy controls, allowing attackers to establish persistence before triggering broader alerts.

IOC Summary

Threat: ua-wget Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["129.121.114.124"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.114.124"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule in an enterprise environment, including suggested filters or exclusions:

• Automated Security Patching and Software Updates

  • Scenario: Enterprise patch management tools (e.g., WSUS, SCCM/MECM, or Ansible) frequently utilize the wget utility on Linux servers to download security patches, configuration files, or software installers from vendor repositories. These downloads often occur during scheduled maintenance windows and may be flagged if the source URL is newly registered with URLhaus but has a generic User-Agent string matching ua-wget.
  • Suggested Filter: Create an exclusion for known internal IP ranges of patch management servers (e.g., 10.x.x.x or specific DMZ subnets) and allowlist specific vendor domains (e.g., *.microsoft.com, *.redhat.com) that are frequently accessed by these automation scripts.

• Cloud Infrastructure Provisioning Scripts

  • Scenario: DevOps teams often run infrastructure-as-code pipelines using tools like Terraform, Jenkins, or GitHub Actions. These CI/CD runners (often hosted on Linux agents) invoke wget to fetch artifacts, Docker images, or configuration manifests from cloud storage buckets (e.g., AWS S3, Azure Blob Storage). If a newly created artifact URL is scanned by URLhaus before it gains significant reputation traffic, the generic ua-wget signature may trigger an alert.
  • Suggested Filter: Exclude traffic originating from known CI/CD runner hostnames or IP addresses (e.g., github-actions-*.runner, specific Jenkins controller IPs) and filter for URLs containing standard cloud storage path patterns (e.g., .s3.amazonaws.com, .blob.core.windows.net).

• **Database Backup and Log Aggregation