URLhaus: rat Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging known RAT-infected endpoints to exfiltrate sensitive data through a specific set of twelve malicious URLs identified by URLhaus. Proactive hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised assets and prevent lateral movement before the remote access trojans establish persistent command-and-control channels.

IOC Summary

Threat: rat Total URLs: 12 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["107.174.146.3", "dawn-mud-d34f.phzinhoooo.workers.dev", "107.173.47.146", "www.mbowen.org", "107.173.143.52", "194.116.236.163", "46.183.223.88", "107.172.247.123", "217.160.121.177", "87.106.48.217"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["107.174.146.3", "dawn-mud-d34f.phzinhoooo.workers.dev", "107.173.47.146", "www.mbowen.org", "107.173.143.52", "194.116.236.163", "46.183.223.88", "107.172.247.123", "217.160.121.177", "87.106.48.217"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: rat Malicious URLs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scheduled Antivirus Definition Updates via Admin Consoles

  • Scenario: Enterprise endpoint management tools like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec Endpoint Protection frequently pull definition updates from vendor repositories. These vendors often host update manifests on dynamic subdomains that URLhaus may flag as “rat” (RAT) due to high traffic volume and dynamic content generation, even though the payload is a legitimate signature file.
  • Filter/Exclusion: Create an allowlist for specific known update endpoints (e.g., *.update.microsoft.com, *.crowdstrike.com) or exclude traffic originating from service accounts running scheduled jobs named “AntivirusUpdate” during maintenance windows (e.g., 02:00–04:00 UTC).

• Software Deployment and Patching via Configuration Management Tools

  • Scenario: During automated patch cycles, tools like Ansible, Chef, or SCCM (System Center Configuration Manager) download software installers from public repositories. If the deployment involves open-source components hosted on platforms like GitHub or specialized vendor portals, URLhaus may classify these high-volume downloads as potential RAT activity due to the nature of the file types and connection patterns.
  • Filter/Exclusion: Exclude traffic where the source IP belongs to the “Patch Management” subnet or filter by specific HTTP User-Agent strings containing identifiers like Ansible-Runner, SCCM-Agent, or Chef-Client. Additionally, whitelist URLs containing paths such as /releases/download or /packages/v2.

• Cloud Storage and Collaboration File Synchronization

  • Scenario: Employees using OneDrive for Business, Google Drive, or