URLhaus: AppleScript Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging malicious AppleScript URLs to execute unauthorized automation tasks or deliver payloads within macOS environments. Proactively hunting for these specific indicators in Azure Sentinel is critical because it enables early detection of supply chain compromises and script-based attacks that may bypass traditional endpoint protections before they escalate into broader incidents.

IOC Summary

Threat: AppleScript Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AppleScript
let malicious_domains = dynamic(["exptersed.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["exptersed.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: AppleScript Malicious URLs detection rule, tailored for an enterprise environment where legitimate automation frequently utilizes AppleScript to fetch external resources.

• Automated Software Inventory via Munki or Jamf Pro

  • Scenario: During nightly maintenance windows, deployment tools like Munki or Jamf Pro execute custom AppleScripts on managed macOS endpoints. These scripts often query the vendor’s update manifest (e.g., https://updates.munki.example.com/catalog.json or https://api.jamfsoftware.com/v1/manifest) to check for new software versions. If the URL contains specific query parameters or redirects that resemble known AppleScript payload patterns, the rule may flag these routine inventory checks as malicious.
  • Suggested Filter: Exclude traffic originating from the specific service accounts used by Munki/Jamf (e.g., svc-munki-updater or jamf-pro-agent) and whitelist the vendor’s primary update domains in the exclusion list.

• Scheduled Compliance Reporting with Power Automate

  • Scenario: A scheduled job running via Microsoft Power Automate triggers a local AppleScript on macOS servers to aggregate compliance data. The script fetches real-time security posture metrics from an internal dashboard hosted at https://security-dashboard.internal.corp/api/v1/status. Because the URL structure includes dynamic tokens and JSON payloads typical of API-driven scripts, it mimics the signature of the malicious URLs detected by the rule.
  • Suggested Filter: Create a filter to exclude connections where the User-Agent header contains “PowerAutomate” or “Microsoft-Flow” combined with destination IPs belonging to the internal corporate subnet (e.g., 10.x.x.x).

• IT Helpdesk Ticket Automation via ServiceNow

  • Scenario: The IT service desk utilizes ServiceNow