URLhaus: cowrie Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors leverage Cowrie-tagged malicious URLs to distribute malware or establish initial command-and-control channels within the network. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of such high-severity URLs enables rapid containment of potential lateral movement and prevents broader compromise before active exploitation occurs.

IOC Summary

Threat: cowrie Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: cowrie
let malicious_domains = dynamic(["176.65.139.202"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.202"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: cowrie Malicious URLs detection rule, along with suggested filters or exclusions tailored for an enterprise environment:

• Automated Security Scanner Traffic (e.g., Qualys or Tenable)

  • Scenario: Enterprise vulnerability scanners frequently probe external URLs to validate asset reachability and security posture. When these tools scan internal honeypot infrastructure or specific Cowrie deployment endpoints, they generate high volumes of HTTP requests that may be flagged as “malicious” by the rule due to the nature of the traffic pattern (high frequency, diverse user agents).
  • Filter/Exclusion: Exclude source IPs belonging to the vulnerability management suite.
    • Example: Source IP IN [10.20.50.1-10.20.50.254] AND Source Hostname CONTAINS "qualys-scanner"

• Scheduled Backup and Reporting Jobs (e.g., Veeam or Splunk Enterprise)

  • Scenario: Scheduled backup agents or reporting engines often initiate outbound connections to cloud storage buckets or external API endpoints for metadata synchronization. If the Cowrie honeypot is part of the reporting chain, these periodic jobs may trigger the rule when accessing specific URL patterns that mimic malicious signatures (e.g., long query strings with encoded parameters).
  • Filter/Exclusion: Filter based on process name and scheduled time windows to ignore known administrative tasks.
    • Example: Process Name IN ["VeeamBackup.exe", "splunkd"] AND Event Time BETWEEN [02:00, 06:00]

• Software Update Mechanisms (e.g., Microsoft System Center Configuration Manager - SCCM)

  • Scenario: Endpoint management tools like SCCM or Intune regularly pull update manifests and configuration files from