URLhaus: 3 Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where malware is delivered via phishing emails or compromised domains to exfiltrate sensitive data and establish system persistence. A proactive hunt in Azure Sentinel is essential to rapidly identify these initial access vectors and prevent lateral movement before attackers can secure long-term footholds within the environment.

IOC Summary

Threat: 3 Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: 3
let malicious_domains = dynamic(["femade.co.uk"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["femade.co.uk"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: 3 Malicious URLs” Rule

• Scenario: Automated Cloud Backup and Synchronization

  • Context: Enterprise backup solutions like Veeam or Microsoft OneDrive/SharePoint frequently initiate outbound connections to cloud storage endpoints that may be flagged as suspicious due to high volume of data transfer (exfiltration behavior) and the use of generic domains hosting payloads.
  • Suggested Filter: Create an exclusion rule for specific backup service accounts (e.g., svc-veeam-backup, svc-onedrive-sync) connecting to known cloud provider IP ranges or whitelisted domains (e.g., *.sharepoint.com, *.veeam.com).

• Scenario: Scheduled Security Scans and Patch Management

  • Context: Automated patching tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Qualys Cloud Agent regularly download update manifests and security definitions from vendor repositories. These downloads often trigger the rule’s logic regarding “compromised domains used to host payloads” as they fetch large files over HTTPS.
  • Suggested Filter: Exclude traffic generated by scheduled tasks running during maintenance windows (e.g., Task Scheduler: SCCM_Updates) where the destination URL matches known vendor update servers (e.g., *.microsoft.com, *.qualys.com).

• Scenario: Legitimate Phishing Simulation and Training

  • Context: Security teams utilize platforms like KnowBe4, Proofpoint, or Covisec to conduct simulated phishing campaigns. These tools send emails containing URLs that mimic the exact structure of the rule’s detection criteria (phishing emails with malicious-looking URLs), intentionally triggering alerts during active training periods.
  • Suggested Filter: Implement a time-based exclusion for traffic originating from the internal mail gateway when