URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of AgentTesla, a remote access trojan often distributed via malicious URLs, which allows adversaries to steal credentials and establish persistent control over compromised endpoints. Proactively hunting for these known malicious URLs in Azure Sentinel enables the SOC team to identify early-stage infections and lateral movement attempts before the malware can fully establish its foothold within the environment.

This hypothesis targets the execution of AgentTesla, a remote access trojan often distributed via malicious URLs, which allows adversaries to steal credentials and establish persistent control over compromised endpoints. Proactively hunting for these known malicious URLs in Azure Sentinel enables the SOC team to identify early-stage infections and lateral movement attempts before the malware can fully establish its foothold within the environment.

IOC Summary

Threat: AgentTesla Total URLs: 4 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["firebasestorage.googleapis.com", "216.9.224.48"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["firebasestorage.googleapis.com", "216.9.224.48"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Checks: Older internal line-of-business applications (e.g., custom Java-based inventory systems or legacy POS terminals) may still be configured to check for updates or license validation against hardcoded, decommissioned endpoints that happen to match one of the known AgentTesla URLs due to IP reuse or domain re-registration.

  • Filter/Exclusion: Exclude source processes known to be legacy applications (e.g., javaw.exe, dotnet.exe running specific legacy assemblies) or exclude specific user accounts associated with these legacy systems (e.g., svc-inventory, pos-admin).

• Browser Caching and Background Sync: Users with multiple browser tabs open or browsers set to “restore session” on startup may trigger network connections to previously visited malicious URLs if the browser attempts to re-validate cached resources or sync history in the background, especially if the URL was previously accessed during a phishing incident before the rule was deployed.

  • Filter/Exclusion: Exclude source processes that are standard web browsers (e.g., chrome.exe, msedge.exe, firefox.exe) if the connection is initiated by a child process of the browser UI or if the event timestamp aligns with browser startup/restore events.

• Scheduled Web Scraping or Monitoring Jobs: IT operations or security teams may run scheduled PowerShell or Python scripts to monitor the status of known malicious domains (e.g., checking if an AgentTesla C2 server is still up or if the certificate has changed) for incident response or threat intelligence purposes.

  • Filter/Exclusion: Exclude source processes associated with monitoring tools (e.g., powershell.exe running from C:\Scripts\ThreatIntel\, python.exe running from C:\Tools\Nmap\) or exclude specific service accounts used for monitoring (e.g., svc-threatintel, svc-monitoring).

• **Web Proxy