URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints access known AgentTesla malicious URLs to deploy information stealing malware that captures keystrokes and screenshots. Proactively hunting these specific indicators in Azure Sentinel is critical because early detection of AgentTesla activity allows the SOC team to isolate compromised hosts before sensitive credentials and user data are exfiltrated.

IOC Summary

Threat: AgentTesla Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["specsaversllc.online", "204.44.93.68"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["specsaversllc.online", "204.44.93.68"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: AgentTesla Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Software Updates

  • Scenario: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons frequently download installer packages and update manifests from third-party software vendors. If a vendor (e.g., a specific antivirus provider or remote access tool) hosts their installation files on a domain recently flagged by URLhaus as containing AgentTesla signatures, the automated update job will trigger the alert every time it refreshes the repository.
  • Filter/Exclusion: Create an exclusion for the specific service account used by the management agent (e.g., svc_sccm_agent or IvantiService) and whitelist the known vendor domain (e.g., downloads.vendor-software.com) if confirmed benign via a sandbox analysis.

• Automated Patch Management Scans

  • Scenario: Scheduled tasks running on patch management servers, such as SolarWinds Patch Manager or ManageEngine Patch Manager Plus, often perform background scans to check for new vulnerabilities. These tools may query external threat intelligence feeds or software repositories that share IP ranges with known AgentTesla command-and-control (C2) infrastructure, causing the scanner’s HTTP requests to be flagged as malicious traffic even though no actual malware is present on the endpoint.
  • Filter/Exclusion: Exclude network traffic originating from the patch management server’s IP address range during specific maintenance windows (e.g., 02:00 - 04:00 UTC) or filter out URLs containing standard API query parameters typical of patch scanning tools (e.g., ?action=scan&version=v3).

• IT Helpdesk and Remote Support Sessions

  • Scenario: