URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints initiate downloads from known malicious URLs identified by URLhaus, indicating potential initial access or execution of malware payloads. Proactively hunting for these specific indicators in Azure Sentinel is critical to rapidly identify and isolate compromised assets before they establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: malware_download Total URLs: 4 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["209.54.101.188", "115.62.58.252", "42.86.112.79"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["209.54.101.188", "115.62.58.252", "42.86.112.79"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, along with suggested filters and exclusions:

• Enterprise Antivirus Definition Updates via Cloud Repositories

  • Scenario: Scheduled nightly jobs on endpoint protection consoles (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) automatically pull the latest virus definition signatures from vendor cloud repositories. These downloads often originate from high-volume content delivery networks (CDNs) that host millions of files daily; URLhaus may flag specific sub-domains or dynamic endpoints used during peak update windows as malware_download due to shared IP reputation issues or transient heuristic triggers.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for known vendor update URLs (e.g., *.update.microsoft.com, *.crowdstrike.com) and exclude traffic originating from the specific service accounts used by the AV management console during scheduled maintenance windows (e.g., 02:00–04:00 UTC).

• Software Deployment via Configuration Management Tools

  • Scenario: Automated deployment pipelines using tools like Ansible, SCCM (System Center Configuration Manager), or Jamf Pro download installer packages (.msi, .exe) from internal artifact repositories (e.g., Artifactory, Nexus) or public software mirrors. When these tools fetch large binary files containing embedded scripts or self-extracting archives, the URLhaus sensor may misinterpret the high-entropy data stream as a malicious payload download, particularly if the source domain is relatively new to the threat intelligence feed.
  • Suggested Filter/Exclusion: Exclude traffic from internal artifact repository CIDR blocks and specific public software mirror domains (e.g., download.microsoft.com, mirror.centos.org). Additionally, filter out alerts where the user agent string matches known deployment tools (e.g., containing “SCCM”, “Ansible”, or