URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of AgentTesla, a remote access trojan (RAT) known for stealing credentials and enabling persistent backdoor access, by identifying traffic to known malicious URLs. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect compromised endpoints early, preventing lateral movement and data exfiltration before the adversary establishes full control.

IOC Summary

Threat: AgentTesla Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["pub-c6d653e19fd545129fdfd7d6f8cd8b17.r2.dev", "pub-72295f71e45d431995028c79cf261dae.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-c6d653e19fd545129fdfd7d6f8cd8b17.r2.dev", "pub-72295f71e45d431995028c79cf261dae.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Check: A legacy line-of-business application (e.g., an older version of SAP GUI or a custom internal tool) configured with a hardcoded URL for license validation or update checks that coincidentally matches one of the AgentTesla URLs due to shared infrastructure or a compromised upstream server.
  • Filter/Exclusion: Exclude processes known to be legacy applications (e.g., sapgui.exe, internal_tool.exe) from the URL detection rule, or whitelist the specific user agent string if the detection relies on HTTP headers.
• Scheduled Maintenance Job: A scheduled task running a PowerShell script or batch file that pings a specific endpoint for health checks or log collection, where the endpoint URL has been repurposed or is part of a shared internal service that overlaps with the malicious URL pattern.
  • Filter/Exclusion: Exclude scheduled tasks with names containing keywords like Maintenance, HealthCheck, or LogCollection, or filter by the specific service account used for these jobs (e.g., svc-maintenance).
• Browser Tab Restoration: An administrator or user restores browser tabs after a system reboot or crash, and one of the restored tabs points to a URL that was previously visited for testing or documentation purposes, which happens to match the AgentTesla URL.
  • Filter/Exclusion: Exclude processes like chrome.exe, msedge.exe, or firefox.exe if the detection is process-based, or filter by the TabRestored event type in browser telemetry if available.
• Development Environment Testing: A developer or QA engineer manually testing a new integration or API endpoint using a browser or tool like Postman, where the test URL is identical to one of the AgentTesla URLs due to a shared staging environment or a typo in the configuration.
  • Filter/Exclusion: Exclude users in the Dev or QA security groups