URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging wget utilities to fetch and execute payloads from known malicious URLs identified by URLhaus. Proactive hunting is essential in Azure Sentinel to identify early-stage command-and-control or initial access activities that may evade standard signature-based detections due to the ubiquitous nature of wget tools.

IOC Summary

Threat: ua-wget Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.174"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.174"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule, along with targeted filters to mitigate noise in an enterprise environment:

• Automated Backup and Sync Scripts: Enterprise backup solutions (e.g., Veeam, Commvault) or cloud sync tools often utilize wget via cron jobs to pull configuration manifests, update catalogs, or fetch incremental backup metadata from vendor portals. These legitimate HTTP requests frequently match the ua-wget signature while accessing trusted domains like s3.amazonaws.com or specific vendor CDNs.

  • Suggested Filter: Exclude traffic where the destination URL domain is within a pre-approved allowlist of internal and vendor domains (e.g., *.aws.amazon.com, *.veeam.com) AND the source process is identified as a known backup service executable (e.g., vbr.exe, commvault_agent.exe).

• DevOps CI/CD Pipeline Artifacts: Continuous Integration platforms like Jenkins, GitLab CI, or Azure DevOps often spin up ephemeral containers to execute build steps. These pipelines frequently use wget or curl to download dependencies (e.g., Maven repositories, Docker images) from public registries during the build phase. The user-agent string in these automated builds is often generic and matches the rule’s criteria.

  • Suggested Filter: Create an exclusion for traffic originating from specific CI/CD subnets or hostnames containing keywords like jenkins, gitlab-runner, or azure-devops. Additionally, filter out URLs ending in common artifact extensions (e.g., .jar, .whl, .tar.gz) accessed by these build agents.

• Patch Management and Software Distribution: System administrators often deploy scheduled tasks using tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible to distribute software updates. These tools may invoke wget to fetch patch manifests, release