URLhaus: WeedHack Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are associated with the WeedHack malware, which is used to deliver malicious payloads and establish command and control channels. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise of endpoints and networks before significant damage occurs.

IOC Summary

Threat: WeedHack Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: WeedHack
let malicious_domains = dynamic(["falseflag1.ru"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["falseflag1.ru"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate system update via URLhaus
  Description: A system update or patch is downloaded from a URLhaus-listed domain that is mistakenly tagged as WeedHack.
  Filter/Exclusion: Exclude URLs associated with known software update servers (e.g., updates.microsoft.com, download.docker.com) or use a filter like:

  (url contains "updates.microsoft.com" or url contains "download.docker.com")

• Scenario: Scheduled backup job using a known safe URL
  Description: A scheduled backup job uses a URL from a trusted source (e.g., AWS S3 bucket) that is falsely flagged as WeedHack.
  Filter/Exclusion: Exclude URLs that match known backup or storage services (e.g., s3.amazonaws.com, backup.example.com) using:

  (url contains "s3.amazonaws.com" or url contains "backup.example.com")

• Scenario: Admin task using a legitimate phishing detection tool
  Description: An admin is using a phishing detection tool (e.g., Cisco Talos Intelligence) that is mistakenly flagged as WeedHack.
  Filter/Exclusion: Exclude URLs related to security tools (e.g., talosintelligence.com, cisco.com) with:

  (url contains "talosintelligence.com" or url contains "cisco.com")

• Scenario: Internal tool for URL scanning with a false positive
  Description: An internal URL scanning tool (e.g., CrowdStrike Falcon, Palo Alto Prisma Access) is flagged as WeedHack due to a misconfiguration.
  Filter/Exclusion: Exclude internal tools by IP or domain, e.g.:

  (src_ip in 10.0.0.0/8 or url contains "internal