URLhaus: Amos Malicious URLs

Hunt Hypothesis

This hunt targets the Amos malware family, which leverages specific malicious URLs to facilitate command-and-control communications or deliver payloads, often indicating a targeted intrusion or web-based attack vector. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious web traffic before the adversary can fully establish persistence or execute lateral movement within the environment.

IOC Summary

Threat: Amos Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Amos
let malicious_domains = dynamic(["roptik.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["roptik.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A marketing or product team uses a staging or pre-production environment URL (e.g., https://staging-amos-cdn.example.com/...) that shares a similar domain structure or subdomain naming convention with the known malicious “Amos” URLs, triggering a fuzzy match or exact substring match in the hunt package.
  • Filter/Exclusion: Exclude URLs containing known staging prefixes (e.g., staging-, preprod-, dev-) or specific internal CDN hostnames (e.g., *.cloudfront.net, *.azureedge.net) if the malicious URLs are hosted on public infrastructure.
• Scenario: An IT administrator or developer is testing a new API integration or debugging a service that references a test endpoint hosted on a public IP or domain that coincidentally matches one of the two Amos URLs (e.g., using a public test server for load balancing or DNS resolution tests).
  • Filter/Exclusion: Exclude traffic from known admin jump hosts, CI/CD runner IPs, or service accounts associated with development/testing environments (e.g., svc-ci-runner, admin-jumpbox-01).
• Scenario: A scheduled job or backup script (e.g., Veeam, Commvault, or a custom PowerShell script) pulls configuration files or logs from a remote repository that happens to be hosted at one of the Amos URLs, possibly due to a legacy setup or a shared public bucket for non-sensitive metadata.
  • Filter/Exclusion: Exclude traffic from known backup or monitoring service accounts (e.g., svc-backup, zabbix-agent, datadog-agent) or specific scheduled task names (e.g., DailyConfigSync, LogRotation).
• Scenario: A web application or microservice makes an outbound HTTP request to a third-party service (e.g., a payment gateway