URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where threat actors utilize wget utilities to download malware or exfiltrate data via known malicious URLs flagged by URLhaus. A SOC team should proactively hunt for this behavior in Azure Sentinel because wget is a common tool often leveraged during the initial execution phase of attacks, and early identification of these specific high-severity indicators can prevent lateral movement and compromise propagation.

IOC Summary

Threat: ua-wget Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.61"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.61"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: ua-wget Malicious URLs”

• Scenario 1: Automated Patch Management Scripts

  • Context: System administrators frequently use wget within PowerShell or Bash scripts to download patch manifests, driver updates, or configuration files from trusted vendor repositories (e.g., Microsoft Update Catalog, Dell Support Site). These downloads often occur via scheduled tasks running under service accounts.
  • Filter/Exclusion: Exclude traffic where the source host is a known “Patch Management Server” and the destination URL domain matches approved vendor domains (e.g., *.microsoft.com, *.dell.com). Additionally, filter out events where the user agent string contains specific script identifiers like Wget/1.21 (linux-gnu) running under the SYSTEM or LocalSystem account.

• Scenario 2: CI/CD Pipeline Artifact Retrieval

  • Context: DevOps pipelines (e.g., Jenkins, GitLab CI) utilize wget as a standard tool to fetch build artifacts, container images, or dependency libraries from internal artifact repositories like Nexus, Artifactory, or GitHub Packages. These jobs often run on ephemeral agents that may not be fully whitelisted in the URL reputation database yet.
  • Filter/Exclusion: Create an exclusion for source IP ranges belonging to the CI/CD infrastructure (e.g., 10.20.x.x subnet) and destination URLs ending in .jar, .zip, or .tar.gz. Furthermore, exclude alerts where the HTTP response code is 304 Not Modified or 200 OK with a known internal artifact repository hostname.

• Scenario 3: Database Backup and Reporting Jobs

  • Context: Scheduled nightly jobs on SQL Server or reporting servers use wget to pull external reference data, currency exchange rates, or