URLhaus: rat Malicious URLs

Hunt Hypothesis

This rule detects the presence of URLs associated with the RAT (Remote Access Trojan) family, indicating potential compromise or lateral movement via malicious web links. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or phishing campaigns before the RAT establishes persistent remote control over the environment.

IOC Summary

Threat: rat Total URLs: 13 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["signageinsignia.co.za", "204.44.93.77", "bun-pullz.b-cdn.net", "212.2.35.14", "107.172.172.220", "107.174.33.14", "64.89.160.97", "192.236.217.110", "107.172.235.223", "96.44.167.210"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["signageinsignia.co.za", "204.44.93.77", "bun-pullz.b-cdn.net", "212.2.35.14", "107.172.172.220", "107.174.33.14", "64.89.160.97", "192.236.217.110", "107.172.235.223", "96.44.167.210"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A security team or developer is actively testing a new URL shortener or redirect service against the URLhaus feed in a staging environment.
  • Filter/Exclusion: Exclude source IPs within the designated 10.20.0.0/24 (Staging Network) or exclude user agents containing Mozilla/5.0 (compatible; SecurityTestBot/1.0).
• Scenario: An automated vulnerability scanner (e.g., Nessus, Qualys, or Acunetix) is performing a scheduled crawl of public-facing web assets and encounters a known malicious URL embedded in a test page or legacy documentation.
  • Filter/Exclusion: Exclude source accounts matching svc-vuln-scan or automated-crawler and exclude HTTP status codes 404 or 302 if the rule triggers on response headers rather than just the request.
• Scenario: A marketing or content team is using a third-party link preview tool (like LinkPreview or a browser extension) that fetches metadata from various URLs, including those flagged by URLhaus, to generate social media cards.
  • Filter/Exclusion: Exclude user agents containing LinkPreview/1.0 or Twitterbot/1.0 and exclude source IPs from the 192.168.10.0/24 (Marketing Office VLAN).
• Scenario: A legacy application or scheduled job (e.g., a nightly data sync script) is making HTTP requests to a deprecated endpoint that has since been added to the URLhaus RAT list due to a recent compromise, but the application itself is still trusted and patched.
  • Filter/Exclusion: Exclude specific process names like python.exe or java.exe when the destination URL matches the known false positive list (e.g