← Back to SOC feed Coverage →

URLhaus: ua-wget Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-05T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversaries leveraging wget utilities to execute malicious downloads from known threat intelligence feeds, indicating potential command-and-control or initial access activities. SOC teams should proactively hunt for these patterns in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement driven by automated script-based attacks.

IOC Summary

Threat: ua-wget Total URLs: 46 Active URLs: 0

URLStatusThreatDate Added
hxxp://5.182.210.61/24d379offlinemalware_download2026-08-05
hxxp://5.182.210.61/14ef86offlinemalware_download2026-08-05
hxxp://5.182.210.61/51c6dcofflinemalware_download2026-08-05
hxxp://5.182.210.61/132db9offlinemalware_download2026-08-05
hxxp://5.182.210.61/4bd178offlinemalware_download2026-08-05
hxxp://5.182.210.61/17f186offlinemalware_download2026-08-05
hxxp://5.182.210.61/78c426offlinemalware_download2026-08-05
hxxp://5.182.210.61/fdf7b4offlinemalware_download2026-08-05
hxxp://5.182.210.61/c18c96offlinemalware_download2026-08-05
hxxp://5.182.210.61/7d759cofflinemalware_download2026-08-05
hxxp://5.182.210.61/4a3a1cofflinemalware_download2026-08-05
hxxp://5.182.210.61/cdbc52offlinemalware_download2026-08-05
hxxp://45.135.194.70/08433cofflinemalware_download2026-08-05
hxxp://45.135.194.70/8a9f29offlinemalware_download2026-08-05
hxxp://5.182.210.61/875901offlinemalware_download2026-08-05
hxxp://5.182.210.61/0f20b0offlinemalware_download2026-08-05
hxxp://45.135.194.70/5b1540offlinemalware_download2026-08-05
hxxp://5.182.210.61/74fa12offlinemalware_download2026-08-05
hxxp://5.182.210.61/5201f2offlinemalware_download2026-08-05
hxxp://5.182.210.61/1cc880offlinemalware_download2026-08-05
hxxp://45.135.194.70/74ef32offlinemalware_download2026-08-05
hxxp://5.182.210.61/add00bofflinemalware_download2026-08-05
hxxp://45.135.194.70/00fec1offlinemalware_download2026-08-05
hxxp://5.182.210.61/226a79offlinemalware_download2026-08-05
hxxp://45.135.194.70/6ad4b4offlinemalware_download2026-08-05

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.61", "45.135.194.70"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.61", "45.135.194.70"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://urlhaus.abuse.ch/