URLhaus: CryptoMiner Malicious URLs

Hunt Hypothesis

This hunt targets adversary infrastructure leveraging known CryptoMiner URLs to establish persistence or exfiltrate data, indicating a potential compromise where attackers are actively mining resources or staging further operations. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify affected assets before the malware can fully propagate or establish a foothold, reducing the window of exposure and minimizing the financial and operational impact of cryptomining activities.

IOC Summary

Threat: CryptoMiner Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: CryptoMiner
let malicious_domains = dynamic(["79.137.203.132"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["79.137.203.132"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legitimate Crypto Asset Management or Exchange Integration

  • Scenario: A financial services firm or internal treasury team uses a proprietary API gateway or dashboard that interacts with legitimate cryptocurrency exchange endpoints (e.g., Coinbase, Kraken, or a private ledger node) for real-time price tracking or automated settlement. If the URLhaus feed includes a generic domain or specific path associated with a legitimate exchange’s API endpoint (e.g., api.coinbase.com/v3/brokerage/...), this rule may trigger on standard HTTPS GET/POST requests from the treasury application server.
  • Filter/Exclusion: Exclude traffic where the source user group is Finance-Treasury AND the destination port is 443 AND the User-Agent header matches the known internal API client (e.g., Treasury-API-Client/2.1). Alternatively, whitelist the specific API subdomain if it is confirmed as a trusted third-party service.

• Development and Testing Environments for Blockchain Projects

  • Scenario: The engineering team is developing a new smart contract platform or dApp and spins up local test nodes or uses staging environments that mimic production crypto-mining or wallet services. During integration testing, developers may manually curl or use Postman to hit specific test URLs that share a domain structure with known malicious URLhaus entries (e.g., a staging domain like test-miner.internal.corp that accidentally matches a public malicious domain due to a typo or shared hosting provider).
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the Dev-Test-Subnet (e.g., 10.20.0.0/24) AND the destination is within the internal staging range. Ensure that any external test URLs are explicitly added to the URL whitelist in the detection logic if they are known to be benign.

• **Scheduled Backup or Sync