This detection identifies adversaries leveraging wget utilities to execute malicious downloads from known threat intelligence feeds, indicating potential command-and-control or initial access activities. SOC teams should proactively hunt for these patterns in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement driven by automated script-based attacks.
Threat: ua-wget Total URLs: 46 Active URLs: 0
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://5.182.210.61/24d379 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/14ef86 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/51c6dc | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/132db9 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/4bd178 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/17f186 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/78c426 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/fdf7b4 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/c18c96 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/7d759c | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/4a3a1c | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/cdbc52 | offline | malware_download | 2026-08-05 |
hxxp://45.135.194.70/08433c | offline | malware_download | 2026-08-05 |
hxxp://45.135.194.70/8a9f29 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/875901 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/0f20b0 | offline | malware_download | 2026-08-05 |
hxxp://45.135.194.70/5b1540 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/74fa12 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/5201f2 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/1cc880 | offline | malware_download | 2026-08-05 |
hxxp://45.135.194.70/74ef32 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/add00b | offline | malware_download | 2026-08-05 |
hxxp://45.135.194.70/00fec1 | offline | malware_download | 2026-08-05 |
hxxp://5.182.210.61/226a79 | offline | malware_download | 2026-08-05 |
hxxp://45.135.194.70/6ad4b4 | offline | malware_download | 2026-08-05 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.61", "45.135.194.70"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.61", "45.135.194.70"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Automated Backup Scripts via Cron Jobs
cron jobs on Linux servers (e.g., Ubuntu or RHEL) to execute backup scripts using the native wget command. These scripts frequently download large configuration files, log archives, or database snapshots from internal repositories or cloud storage buckets (like AWS S3 or Azure Blob), which may be flagged as “ua-wget” traffic despite being benign.10.x.x.x, 192.168.x.x) and specific known backup domains (e.g., *.company-backup.internal.com). Additionally, filter out traffic where the User-Agent string contains custom identifiers like wget/1.21 (linux-gnu) combined with a specific host header matching internal infrastructure.CI/CD Pipeline Artifact Retrieval
wget within build agents to pull dependencies, Docker images, or release artifacts from package registries (e.g., Maven Central, PyPI, or internal Nexus repositories). These automated pulls occur during build windows and are often tagged as malicious due to the generic User-Agent.jenkins-build-01, gitlab-runner). Filter based on the source IP of the build cluster and whitelist specific artifact repository domains (e.g., repo.maven.apache.org, registry.npmjs.org).**Patch Management