URLhaus: exe Malicious URLs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging known malicious executable delivery via compromised web endpoints to initiate initial access and payload execution within our environment. Proactively hunting for these specific URLhaus-tagged threats in Azure Sentinel is critical to intercept early-stage infection vectors before they establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: exe Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: exe
let malicious_domains = dynamic(["91.92.42.232", "watchbeam.tv"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.42.232", "watchbeam.tv"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: exe Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Microsoft Office Click-to-Run Updates via Internal Proxy

  • Scenario: The Microsoft Office Click-to-Run service (specifically OfficeC2RClient.exe or OfficeClickToRun.exe) frequently downloads update manifests and binaries from internal proxy-cached versions of officecdn.microsoft.com. URLhaus may flag the specific hash of these cached .exe payloads as “malicious” due to shared infrastructure with known third-party downloaders, even though the content is benign.
  • Filter/Exclusion: Exclude traffic where the source process name contains OfficeClickToRun.exe or OfficeC2RClient.exe AND the destination domain matches *.officecdn.microsoft.com.

• Automated Patch Deployment via SCCM/MECM

  • Scenario: During scheduled maintenance windows, System Center Configuration Manager (SCCM) agents (ccmexec.exe) pull executable patches from internal distribution points or external vendor repositories (e.g., Adobe, Java). If the rule triggers on the initial handshake URL for a legitimate patch installer hosted on a shared CDN, it may generate an alert despite the file being signed and trusted by the organization.
  • Filter/Exclusion: Create an exclusion for source processes matching ccmexec.exe or TaskScheduler.exe when accessing URLs containing known vendor domains (e.g., *.adobe.com, java.com) during defined maintenance hours (e.g., 02:00–06:00 local time).

• IT Admin Script Execution for Software Distribution

  • Scenario: IT administrators frequently run PowerShell or batch scripts to distribute new software versions. These scripts often invoke powershell.exe or `cmd