URLhaus: ua-wget Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging wget user agents to access known malicious URLs, a behavior often indicative of initial command-and-control communication or lateral movement within compromised hosts. Proactively hunting for these specific URL patterns in Azure Sentinel is critical because it enables the SOC team to identify and isolate early-stage infections before they escalate into broader network compromises.

IOC Summary

Threat: ua-wget Total URLs: 11 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: ua-wget
let malicious_domains = dynamic(["129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: ua-wget Malicious URLs detection rule, along with recommended filters and exclusions:

• Automated Backup Scripts on Linux Servers

  • Scenario: System administrators frequently use wget within cron jobs or systemd timers to fetch daily configuration snapshots, backup manifests, or patch lists from internal repositories (e.g., Artifactory, Nexus) or public CDNs. If the script downloads a file from a URL that has been recently flagged by the community as suspicious but is actually safe for your environment, it triggers an alert.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from specific backup server hostnames (e.g., backup-srv-01.corp.local) or source IP ranges where the User-Agent string matches ^wget/[0-9]+\.[0-9]+ and the destination domain is in your internal DNS zone.

• CI/CD Pipeline Artifact Retrieval

  • Scenario: In a DevOps environment, Jenkins, GitLab CI, or Azure DevAgents often execute build steps that use wget to pull Docker images, Maven artifacts, or Helm charts from public registries (like Docker Hub or GitHub Releases). These high-volume downloads can hit URLs that URLhaus has tagged as “ua-wget” malicious due to global scanning trends, even though the specific artifact is benign and required for deployment.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the CI/CD subnet (e.g., 10.50.20.0/24) AND the destination URL path contains known artifact identifiers (e.g., /artifacts/, /releases/, or specific hash strings). Additionally, filter out traffic destined for trusted public registries like *.docker.com or api.github.com.

• **Patch Management and