URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging phishing campaigns or compromised web resources to deliver initial malware payloads that subsequently download and execute secondary malicious components. Proactively hunting for these specific URLhaus indicators in Azure Sentinel is critical to intercept early-stage infection vectors before they establish command-and-control channels or facilitate lateral movement across the network.

IOC Summary

Threat: malware_download Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["123.10.143.34", "119.114.152.67"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.10.143.34", "119.114.152.67"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: malware_download Malicious URLs rule in an enterprise environment, along with targeted filters or exclusions:

• Automated Software Patching and Updates

  • Scenario: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager, Ivanti, or Jamf) frequently download update packages from vendor repositories. These downloads often originate from dynamic subdomains that URLhaus may flag as “malware_download” due to the high volume of new payloads and the nature of executable downloads (.msi, .exe) typical of patching cycles.
  • Filter/Exclusion: Create a whitelist exclusion for traffic originating from known internal management servers (e.g., SCCM-Server-01) or specific vendor IP ranges (e.g., Microsoft Update CDN IPs). Additionally, exclude URLs containing standard update paths like /update, /patch, or /deploy when the source process is ccmexec.exe or JamfProAgent.

• IT Admin Manual Troubleshooting and Tool Deployment

  • Scenario: System administrators often manually download diagnostic utilities (e.g., Sysinternals Suite, Wireshark, Nmap) from the official vendor websites to troubleshoot live incidents. These tools are designed to download additional components or scripts upon execution, mimicking the “delivery mechanism” behavior described in the rule logic.
  • Filter/Exclusion: Implement a user-based exclusion for accounts within the IT-Admins or Security-Ops groups. Correlate alerts with the source process name; if the initiating process is a known browser (e.g., chrome.exe, msedge.exe) launched by an admin account accessing domains like learn.microsoft.com, wireshark.org, or technet.microsoft.com, suppress the alert.