URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of AgentTesla malware through known malicious URLs that facilitate credential theft and data exfiltration. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage infections before attackers can compromise sensitive user credentials or establish persistent access within the environment.

IOC Summary

Threat: AgentTesla Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["pub-153d2a9e026942c4aff3b3aca8f80952.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-153d2a9e026942c4aff3b3aca8f80952.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: AgentTesla Malicious URLs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Qualys or Tenable

  • Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Platform, Tenable Nessus) frequently probe external web resources to validate certificate chains and network reachability. These tools often generate traffic to URLs that URLhaus has previously flagged as “AgentTesla” related but are currently safe or part of a known library update mechanism.
  • Filter/Exclusion: Create an exclusion rule based on the Source Host being a member of the Vulnerability-Scanners security group, OR filter out traffic where the User-Agent string contains specific scanner signatures (e.g., qualys-cloud-agent, Tenable-Nessus).

• Scenario: Scheduled Software Updates via Microsoft Update or SCCM

  • Context: During peak maintenance windows, Configuration Manager (SCCM) or Windows Update agents download patches and telemetry data from Microsoft content delivery networks. AgentTesla is a popular remote access tool often used by vendors; legitimate update servers may host components that share URL patterns with the malicious signature.
  • Filter/Exclusion: Exclude traffic originating from WSUS-Server or SCCM-Distribution-Point hosts where the destination port is 443 and the HTTP method is GET. Additionally, add a time-based filter to suppress alerts during defined maintenance windows (e.g., Sunday 02:00 – 06:00 UTC).

• Scenario: Legitimate Remote Support Sessions by IT Helpdesk

  • Context: The internal IT support team utilizes AgentTesla for legitimate remote troubleshooting of end-user workstations. When a helpdesk technician initiates