URLhaus: cowrie Malicious URLs

Hunt Hypothesis

This rule detects potential compromise by identifying traffic to known malicious URLs associated with the Cowrie honeypot framework, which adversaries often use to host phishing payloads or distribute malware. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify early-stage web-based attacks and isolate affected assets before lateral movement or data exfiltration occurs.

IOC Summary

Threat: cowrie Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: cowrie
let malicious_domains = dynamic(["74.81.40.155"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["74.81.40.155"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) uses a hardcoded health check script that periodically pings a specific endpoint on the cowrie domain (or a subdomain) to verify API connectivity. This is often done via a scheduled cron job or Windows Task Scheduler entry named AppHealthMonitor.

  • Filter/Exclusion: Exclude alerts where the source process is a known service executable (e.g., java.exe, dotnet.exe) and the destination URL matches the specific cowrie tag in the URLhaus feed, provided the source IP is within the internal application server subnet.

• CI/CD Pipeline Dependency Scans: A DevOps team uses a security scanning tool (e.g., Trivy, Snyk, or OWASP ZAP) in a CI/CD pipeline (e.g., Jenkins or GitHub Actions) that includes a step to validate external dependencies against known malicious URL lists. The tool may fetch the cowrie URL list or test connectivity to a sample malicious URL to ensure the scanner is functioning correctly.

  • Filter/Exclusion: Exclude alerts originating from CI/CD runner agents (e.g., jenkins-agent, github-runner) where the user context is a service account (e.g., svc-ci-runner) and the process is a known scanning tool binary.

• Web Browser Developer Testing: A QA engineer or developer is manually testing a new feature that involves URL parsing or redirect handling. They may intentionally visit a known malicious URL (tagged as cowrie in URLhaus) in a browser to verify that the application correctly blocks or logs the request without crashing.

  • Filter/Exclusion: Exclude alerts where the source process is a standard browser executable (chrome.exe, msedge.exe, firefox.exe) and the user is