URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hypothesis targets the presence of AgentTesla malware, which exfiltrates credentials and sensitive data via malicious URLs often delivered through phishing campaigns. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints and unusual outbound traffic patterns before the adversary achieves lateral movement or completes data exfiltration.

IOC Summary

Threat: AgentTesla Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["pub-7390aebc53504408b09c0dc5390d6cc4.r2.dev", "pub-82f13abd468442119ddfb068e9f5ad33.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-7390aebc53504408b09c0dc5390d6cc4.r2.dev", "pub-82f13abd468442119ddfb068e9f5ad33.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legitimate Software Update Check via Compromised/Shared Domain: A third-party application (e.g., Adobe Creative Cloud, Java, or a specific vendor’s management agent) performs a routine integrity check or license validation against a domain that has been recently taken over by an attacker or is listed in URLhaus due to a shared infrastructure overlap. The malware signature may flag the domain as malicious, but the traffic is initiated by a trusted service account.

  • Filter/Exclusion: Exclude outbound HTTPS traffic to the specific URLhaus domain if the source process is a known trusted binary (e.g., AdobeUpdateService.exe, java.exe) and the source user account belongs to a standard application service group rather than an interactive user.

• Phishing Simulation Campaigns: Security teams conduct regular phishing simulations using tools like GoPhish or KnowBe4, which often utilize unique, short-lived domains or URLs that may be temporarily flagged in threat intelligence feeds like URLhaus if the simulation infrastructure is reused or if the domain is newly registered.

  • Filter/Exclusion: Exclude alerts where the source user account is tagged with a “Phishing Simulation” attribute in Active Directory or the identity provider, or where the destination URL contains a known simulation path segment (e.g., /sim/, /test/) and the source IP is within the internal security lab subnet.

• Scheduled Backup or Sync Jobs: Enterprise backup solutions (e.g., Veeam, Commvault) or cloud sync clients (e.g., OneDrive for Business, SharePoint) may connect to external endpoints for telemetry, license verification, or delta sync. If a backup server or sync client uses a domain that has been added to URLhaus due to a recent compromise in a different tenant, it may trigger the rule.

  • Filter/Exclusion: Exclude traffic from known backup or sync service accounts (e.g., `svc-backup