URLhaus: opendir Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior involving initial access or command execution through known ‘opendir’ malicious URLs identified by URLhaus, which often serve as entry points for malware delivery and lateral movement. The SOC team should proactively investigate these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent the spread of threats before they establish persistence within the cloud environment.

IOC Summary

Threat: opendir Total URLs: 6 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: opendir
let malicious_domains = dynamic(["41.216.189.92"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["41.216.189.92"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: opendir Malicious URLs detection rule, along with targeted filters or exclusions:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently perform background checks against known threat intelligence feeds. When these agents update their local definition databases, they may initiate HTTP/HTTPS requests to opendir-tagged domains hosted by the vendor’s cloud infrastructure to validate URL reputation before allowing traffic.
  • Filter/Exclusion: Create an exclusion based on the Process Name (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe) and restrict the rule to trigger only when the initiating process is not a known security agent. Alternatively, whitelist specific vendor IP ranges associated with these update servers.

• Scheduled Vulnerability Assessment by IT Management Tools

  • Scenario: Network vulnerability scanners (such as Tenable Nessus, Qualys, or Rapid7 InsightVM) are often scheduled to run nightly scans against internal and external assets. During the “Discovery” phase, these tools probe various web endpoints to check for open ports and service banners. If a target server redirects traffic through an opendir-tagged load balancer or CDN node (common in enterprise DMZs), the scanner’s probing activity will generate valid hits against this rule.
  • Filter/Exclusion: Exclude alerts where the Source IP belongs to the internal “Management” subnet (e.g., 10.x.x.x reserved for scanners) or filter by the specific User Agent string of the scanning tool (e.g., containing “Nessus” or “Qualys”).