URLhaus: cowrie Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of known malicious payloads associated with the Cowrie honeypot framework, which adversaries frequently use to deploy backdoors or establish initial footholds in compromised environments. Proactively hunting for these specific URLs in Azure Sentinel allows the SOC to identify potential lateral movement or persistence mechanisms before they mature into full-blown intrusions, leveraging high-fidelity threat intelligence to reduce mean time to detection.

IOC Summary

Threat: cowrie Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: cowrie
let malicious_domains = dynamic(["176.65.139.235"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.235"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice, and the build script fetches configuration files or dependencies from a staging environment that shares the same IP/hostname as the Cowrie honeypot due to a temporary DNS alias or internal load balancer misconfiguration.
  • Filter/Exclusion: Exclude network connections where the source process is a known CI/CD agent (e.g., jenkins.exe, github-actions-runner.exe) or where the destination port is standard HTTP/HTTPS (80/443) and the source user account belongs to the svc-ci or build-service group.
• Scenario: A security team runs a periodic vulnerability scan using a tool like Nessus or Qualys, which actively probes known honeypot IPs to validate detection coverage or test firewall rules, resulting in legitimate HTTP GET requests to the Cowrie URL.
  • Filter/Exclusion: Exclude events where the source process is a recognized scanning tool (e.g., nessus.exe, qualys-agent.exe) or where the source user account is part of the sec-scanners AD group.
• Scenario: An automated backup job (e.g., Veeam or Commvault) uses a REST API to query storage metadata or verify checksums against a backup repository that happens to be hosted on a server with an IP address matching the Cowrie entry due to a shared infrastructure cluster.
  • Filter/Exclusion: Exclude connections where the source process is a backup agent (e.g., veeam.exe, commvault-agent.exe) and the destination port is 443, specifically filtering out user accounts named svc-backup or backup-service.
• Scenario: A web application developer tests a new feature by pointing a local development server (e