This detection identifies adversary activity where attackers utilize wget user agents to access known malicious URLs, often indicating automated reconnaissance or initial payload delivery stages of an attack. The SOC team should proactively hunt for this behavior in Azure Sentinel to rapidly isolate compromised endpoints and block command-and-control traffic before lateral movement occurs.
Threat: ua-wget Total URLs: 37 Active URLs: 0
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://5.182.210.174/6501cd | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/d72242 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/84e985 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/76e8cc | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/9cb1d9 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/7ba4cb | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/8f41cf | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/f41d69 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/9e14a1 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/f4403a | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/c1e2ea | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/6441d0 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/4a200f | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/ea4b38 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/d69405 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/dca7ad | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/0654cb | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/05416a | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/9ea4b7 | offline | malware_download | 2026-08-10 |
hxxp://94.154.43.60/fallen.arm4 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/17949b | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/e40c97 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/894fc5 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/650040 | offline | malware_download | 2026-08-10 |
hxxp://5.182.210.174/e00f60 | offline | malware_download | 2026-08-10 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["5.182.210.174", "94.154.43.60"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["5.182.210.174", "94.154.43.60"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scheduled Backup Scripts
wget to download daily configuration manifests, license files, or incremental patch lists from internal repositories. If the script’s User-Agent string defaults to “Wget” and targets a URL that has been previously flagged by URLhaus due to a transient issue, it triggers this rule.powershell.exe or specific backup binaries (e.g., veeamtransport.exe) connecting to known internal IP ranges or whitelisted domains (e.g., *.corp.internal, *.backup.vendor.com).CI/CD Pipeline Artifacts
wget command within build agents to fetch dependencies, Docker images, or release notes from public repositories (e.g., GitHub Releases, Maven Central). The build agent’s User-Agent often identifies as “Wget,” and if a specific artifact URL was recently added to the malicious list by URLhaus but is actually safe for this pipeline.jenkins-build-01, gitlab-runner) and whitelist specific destination domains known to host build artifacts, such as github.com, maven.apache.org, or internal artifact registries.Patch Management & Software Deployment
wget in the background to download software installation packages and update definitions from Microsoft Update servers or third-party vendor portals