URLhaus: apk Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors distribute malicious Android application packages (APKs) through compromised or newly registered web domains to initiate mobile endpoint infections. A SOC team should proactively hunt for these specific URL patterns in Azure Sentinel to intercept early-stage delivery mechanisms that often bypass traditional static file analysis, thereby preventing the initial compromise of mobile devices within the organization.

IOC Summary

Threat: apk Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: apk 
let malicious_domains = dynamic(["176.65.139.226"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.226"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: apk Malicious URLs detection rule, along with targeted filters and exclusions:

• Scenario: Automated Mobile Device Management (MDM) Policy Distribution

  • Context: Enterprise MDM solutions like Microsoft Intune, Jamf, or VMware Workspace ONE frequently push .apk installation packages to Android devices via a central repository URL. The rule may flag these legitimate distribution URLs as malicious if the specific APK hash is new or if the URL structure matches known threat patterns.
  • Filter/Exclusion: Create an exclusion for traffic originating from internal MDM server FQDNs (e.g., *.intune.microsoft.com, *.jamfsoftware.com) where the HTTP response content type includes application/vnd.android.package-archive.

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: DevOps teams using tools like Jenkins, GitLab CI, or Azure DevOps often deploy build artifacts (APK files) to internal artifact repositories such as Nexus Repository Manager or Artifactory. When a scheduled nightly job downloads the latest build for testing, the URL containing the APK path may trigger the rule.
  • Filter/Exclusion: Exclude URLs matching the pattern *.nexus.internal or *.artifactory.corp specifically when the user agent string contains keywords like “Jenkins,” “GitLab-runner,” or “Azure-Pipelines.”

• Scenario: Scheduled Endpoint Security Agent Updates

  • Context: Endpoint protection suites such as CrowdStrike Falcon, SentinelOne, or Carbon Black perform scheduled updates to their mobile detection engines. These updates often involve downloading a configuration APK or a lightweight agent module from the vendor’s update server, which can be misidentified as a malicious APK URL by