URLhaus: Amos Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints access known Amos malware distribution channels via specific malicious URLs identified by URLhaus. Proactively hunting for these indicators in Azure Sentinel is critical to detect early-stage infection vectors and prevent lateral movement before the malware establishes persistence on compromised hosts.

IOC Summary

Threat: Amos Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Amos
let malicious_domains = dynamic(["nightmare-download.pw", "nightmare-cheats.vip"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["nightmare-download.pw", "nightmare-cheats.vip"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Amos Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Enterprise Software Update Scanners

  • Scenario: Legitimate background agents such as Microsoft System Center Configuration Manager (SCCM) or Ivanti Endpoint Manager frequently query the Amos update servers to check for security patches and definition updates. These scheduled tasks often generate high-volume HTTP/HTTPS traffic that matches the Amos signature, even though the traffic is authorized and benign.
  • Filter/Exclusion: Create an exclusion rule based on the Source IP range of the internal management server or the specific Process Name (e.g., ccmexec.exe, ivantiagent.exe) to bypass alerts when these known update agents access Amos domains.

• Third-Party Cloud Backup and Sync Services

  • Scenario: Enterprise data protection tools like Veeam Backup & Replication, Rubrik, or Druva often utilize the Amos infrastructure for their cloud storage gateways or metadata synchronization services. During nightly backup windows, these agents establish persistent connections to Amos endpoints, triggering the detection logic despite being part of a standard operational workflow.
  • Filter/Exclusion: Implement a filter that excludes traffic originating from specific Service Accounts (e.g., svc-veeam-backup) or whitelists the destination URLs associated with the organization’s known cloud backup vendor contracts within the URLhaus feed.

• Automated Compliance and Patch Management Jobs

  • Scenario: Scheduled compliance scanning jobs running via tools like Qualys, Tenable Nessus, or SolarWinds Patch Manager periodically scan external threat intelligence feeds, including Amos, to validate network security posture. These scans are typically triggered by a cron job or Windows