URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints access known malicious URLs associated with AgentTesla malware to facilitate initial infection or command-and-control communication. Proactively hunting for these specific indicators in Azure Sentinel is critical because AgentTesla’s capability for keylogging and credential theft necessitates immediate identification of compromised hosts to prevent lateral movement and data exfiltration.

IOC Summary

Threat: AgentTesla Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["pub-1c4ef2a315ec4b89b9dfad9472afee69.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-1c4ef2a315ec4b89b9dfad9472afee69.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the URLhaus: AgentTesla Malicious URLs detection rule:

• Scenario 1: Automated Software Deployment via Endpoint Management Tools

  • Context: Enterprise endpoint management platforms (e.g., Microsoft Intune, Ivanti Neurons, or Jamf) frequently push software updates or installers that download payloads from the same cloud storage providers often associated with AgentTesla distribution. If a deployment job triggers a download of an installer containing a generic URL structure similar to known malicious patterns, it may trigger the rule.
  • Filter/Exclusion: Exclude traffic originating from the specific IP ranges of the Endpoint Management Service (e.g., *.intune.microsoft.com, *.ivanti.com) or create a whitelist for the specific installer .exe hash if the download occurs during scheduled maintenance windows.

• Scenario 2: Scheduled Backup and Synchronization Jobs

  • Context: Automated backup solutions like Veeam, Rubrik, or cloud sync tools such as OneDrive for Business and Google Drive often utilize dynamic URLs to fetch metadata, configuration files, or large data chunks. These tools may generate URL patterns that share signature characteristics with the AgentTesla detection logic, particularly when accessing external storage buckets during off-hours.
  • Filter/Exclusion: Implement a filter based on the User-Agent string of the backup/sync service (e.g., excluding requests where User-Agent contains “Veeam.Backup” or “OneDriveSync”) and restrict the rule to exclude traffic from known internal backup subnets.

• Scenario 3: Legitimate Third-Party Telemetry and Analytics Beacons

  • Context: Corporate browsers (e.g., Microsoft Edge, Google Chrome) configured with enterprise extensions for analytics or security monitoring often send telemetry data to