URLhaus: amos Malicious URLs

Hunt Hypothesis

This hunt identifies potential compromise vectors by detecting traffic to known malicious URLs associated with the “amos” threat actor, indicating that an adversary may be using these endpoints for command-and-control or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify affected assets early, preventing lateral movement or data exfiltration before the threat actor can fully establish a foothold in the environment.

IOC Summary

Threat: amos Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat:  amos
let malicious_domains = dynamic(["loop-lumen.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["loop-lumen.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a microservice, where the build script dynamically fetches configuration or artifact metadata from a staging endpoint that shares a subdomain or IP range with the amos malicious URL list.
  • Filter/Exclusion: Exclude traffic where the User-Agent contains Jenkins or GitHub-Actions and the destination port is 443, provided the source IP is within the known CI/CD subnet (e.g., 10.20.0.0/24).
• Scenario: An automated backup solution (e.g., Veeam or Commvault) performs a verification step by pinging a remote repository or catalog server to check connectivity before initiating a full backup job, which may resolve to an IP or hostname associated with the amos tag due to shared infrastructure or DNS aliasing.
  • Filter/Exclusion: Exclude connections from known backup server hostnames (e.g., backup-server-01.corp.local) where the process name is vbrd.exe or cvpp.exe and the connection is established during the scheduled backup window (e.g., 02:00–04:00 UTC).
• Scenario: A security monitoring agent (e.g., CrowdStrike Falcon or SentinelOne) performs a periodic license validation or telemetry upload to a cloud endpoint that shares a CDN or load balancer IP with the amos malicious URLs, particularly if the agent is configured to use a generic public endpoint for updates.
  • Filter/Exclusion: Exclude traffic where the User-Agent contains Falcon or SentinelOne and the destination is a known public SaaS IP range (e.g., AWS Global Accelerator IPs) with a consistent TLS certificate subject matching the vendor’s domain.