URLhaus: connectwise Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging the ConnectWise brand to distribute malware or establish initial access through known malicious URLs, often used in targeted phishing or supply chain attacks. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic patterns before the malicious payload executes or establishes persistence within the environment.

IOC Summary

Threat: connectwise Total URLs: 11 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: connectwise
let malicious_domains = dynamic(["angefundsu.sbs", "portal.onepansol.site", "thankful-cliff-01dfec010.7.azurestaticapps.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["angefundsu.sbs", "portal.onepansol.site", "thankful-cliff-01dfec010.7.azurestaticapps.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A network operations center (NOC) engineer uses a third-party URL shortener or link preview service (e.g., Bitly, TinyURL, or a custom internal service) to share a dashboard link with a client. If the shortening service’s backend infrastructure coincidentally hosts one of the 11 known ConnectWise malicious URLs (or if the URL is cached/redirected through a shared CDN node associated with the threat actor), the detection may fire on the shortened link or the redirect chain.

  • Filter/Exclusion: Exclude URLs that match the pattern https://[shortener-domain]/[hash] where the User-Agent header indicates a known browser or link preview bot (e.g., Mozilla/5.0 with LinkPreview or Twitterbot), or specifically exclude known internal shortener domains (e.g., shorten.internal.corp.com) if the malicious URLs are hosted on external infrastructure.

• Scenario: An IT administrator performs a manual security audit by visiting the 11 known malicious URLs in a browser to verify their status (e.g., checking if they return a 404, 301, or 200 status code) or to capture screenshots for a report. This is a common practice in threat intelligence validation.

  • Filter/Exclusion: Exclude traffic where the User-Agent contains security-audit, threat-hunt, or manual-verification, or restrict the rule to only trigger if the HTTP response status is 200 OK AND the Content-Type is text/html or application/javascript (excluding 404 Not Found or 301/302 Redirect responses), as malicious URLs often rely on successful content delivery.

• Scenario: A developer or QA engineer uses a web-based API testing tool (e.g