URLhaus: Amos Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving connections to known malicious URLs associated with the Amos threat campaign, which often leverage web-based delivery mechanisms to compromise endpoints. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage lateral movement or initial access attempts before they escalate into broader incidents within the organization’s network.

IOC Summary

Threat: Amos Total URLs: 8 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Amos
let malicious_domains = dynamic(["192.162.199.249"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.162.199.249"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Amos Malicious URLs detection rule in an enterprise environment, along with targeted filtering strategies:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to validate certificate chains and connectivity. These tools often generate HTTP requests to known malicious URL patterns during their discovery phase, triggering the Amos rule even though the traffic is benign and controlled by the security team.
  • Filter/Exclusion: Create a network-based exclusion for the specific IP ranges of the security scanners (e.g., 10.20.50.x) or filter out traffic where the User-Agent string contains keywords like “Nessus”, “Qualys”, or “Rapid7”.

• Scenario: Scheduled Backup and Replication Jobs

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or Commvault often initiate scheduled jobs that pull metadata or verify connectivity to external cloud repositories. If these repositories utilize URLs flagged by URLhaus as Amos-related, the periodic heartbeat checks will generate false alerts during maintenance windows (e.g., nightly at 02:00 UTC).
  • Filter/Exclusion: Implement a time-based exclusion window for backup server IPs (e.g., 192.168.10.x) between 01:00 and 05:00 local time, or exclude specific destination domains known to be part of the backup infrastructure (e.g., *.veeam.com, *.rubrik.com).

• Scenario: Software Update Mechanisms

  • Context: Critical enterprise applications like Microsoft Office, Adobe Creative Cloud, or Zoom utilize background services