URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known AgentTesla URLs, which are frequently used to deliver the AgentTesla infostealer for credential harvesting and remote access. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or web sessions before the malware establishes persistence or exfiltrates sensitive data.

IOC Summary

Threat: AgentTesla Total URLs: 5 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["epsinf.com", "blueoceanealtd.co.ke"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["epsinf.com", "blueoceanealtd.co.ke"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps team uses a CI/CD pipeline (e.g., Azure DevOps or Jenkins) to deploy a custom internal monitoring agent that fetches configuration or telemetry data from a staging endpoint. If the staging environment’s URL is inadvertently registered on URLhaus due to a shared IP or similar path structure, the legitimate curl or wget calls from build agents will trigger the rule.

  • Filter/Exclusion: Exclude processes named curl.exe, wget.exe, or powershell.exe when the parent process is a known CI/CD agent (e.g., vstsagent.exe, jenkins-agent.jar) and the destination URL matches the internal staging domain pattern (e.g., *.staging.internal.corp).

• Scenario: An IT administrator runs a scheduled PowerShell script during maintenance windows to update a legacy line-of-business application. The script downloads a patch file or configuration bundle from a vendor’s distribution server. If the vendor’s CDN or distribution URL has been recently flagged by URLhaus (possibly due to a compromise or misclassification), the download activity will generate an alert.

  • Filter/Exclusion: Exclude events where the process is powershell.exe or cmd.exe and the command line contains explicit download verbs (Invoke-WebRequest, curl, wget) targeting known vendor domains (e.g., *.vendor-cdn.com) during defined maintenance hours (e.g., 02:00–04:00 UTC).

• Scenario: A security team performs a red team exercise or internal penetration test, intentionally using AgentTesla C2 infrastructure or mimicking its URL patterns to validate detection coverage. The testers use tools like Cobalt Strike or Beacon to connect to the known malicious URLs, triggering the rule as expected but creating noise in the SOC queue if not tagged.

  • **Filter