URLhaus: sh Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints access newly identified malicious URLs flagged by the URLhaus community, indicating potential command-and-control communication or initial phishing delivery. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised assets and block emerging threats before they escalate into broader lateral movement incidents.

IOC Summary

Threat: sh Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: sh
let malicious_domains = dynamic(["129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: sh Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Scheduled Software Updates via Package Managers

  • Scenario: Automated maintenance windows where tools like Chocolatey, WSUS (Windows Server Update Services), or Ansible pull update manifests and installer packages from public repositories. These scripts often fetch URLs that are dynamically generated or hosted on shared CDNs, which may be flagged by URLhaus as “sh” (shell script) related threats due to high traffic volume or recent domain registration.
  • Filter/Exclusion: Create a whitelist rule excluding outbound connections from the specific service accounts running these tools (e.g., svc-choco, NT AUTHORITY\SYSTEM on Ansible controllers) targeting known update domains (e.g., *.chocolatey.org, *.microsoft.com) during defined maintenance windows.

• DevOps CI/CD Pipeline Artifact Retrieval

  • Scenario: Build agents in Jenkins, GitLab CI, or Azure DevOps executing shell scripts (sh) to download dependencies, Docker images, or configuration files from internal artifact registries (like Nexus or Artifactory) that proxy external content. The detection logic may misinterpret the high-frequency, script-driven HTTP requests as suspicious “sh” activity if the registry’s public-facing URL is flagged by URLhaus for generic shell execution patterns.
  • Filter/Exclusion: Exclude traffic originating from the IP ranges of the CI/CD build nodes and restrict the exclusion to user agents containing specific pipeline identifiers (e.g., Jenkins, GitLab Runner) accessing internal artifact registry domains.

• Endpoint Detection and Response (EDR) Telemetry & Script Execution

  • Scenario: EDR solutions like **CrowdStrike