URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints download files from newly identified malicious URLs flagged by URLhaus as active malware distribution points. Proactively hunting these specific indicators in Azure Sentinel is critical to intercept early-stage infection vectors before they establish persistence or exfiltrate sensitive data across the organization.

IOC Summary

Threat: malware_download Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["163.142.92.113", "61.53.95.238", "103.179.240.227"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["163.142.92.113", "61.53.95.238", "103.179.240.227"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Definition Updates via Vendor Portals

  • Scenario: Enterprise Endpoint Protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download large signature definition updates directly from vendor update servers. These downloads often originate from dynamic IP ranges and URLs that URLhaus may flag as “malware_download” due to the high volume of traffic or specific file hashing behaviors associated with security payloads.
  • Suggested Filter: Exclude outbound connections where the destination domain matches known vendor update domains (e.g., *.crowdstrike.com, *.update.microsoft.com) and the user agent string contains the specific AV product name (e.g., CrowdStrike Falcon Sensor or Microsoft Defender).

• Automated Software Patching via Configuration Management Tools

  • Scenario: Scheduled jobs running on configuration management servers (e.g., Ansible, SCCM/MECM, or Puppet) pull software patches and installer packages from public repositories like GitHub Releases, Chocolatey, or vendor-specific download portals. These legitimate bulk downloads can trigger the rule if the URL contains parameters often associated with malware distribution links.
  • Suggested Filter: Create an exclusion for traffic originating from specific service accounts (e.g., svc-ansible, SCCM-System) and destination URLs ending in common package extensions (.msi, .exe, .zip) hosted on trusted infrastructure domains (e.g., github.com, chocolatey.org).

• IT Admin Manual Downloads from Trusted Partner Portals

  • Scenario: System administrators regularly log into third-party partner portals (such as Cisco Software Download, VMware Customer Connect, or AWS Artifact) to manually download drivers, firmware images, and compliance reports. These portals