URLhaus: exe Malicious URLs

Hunt Hypothesis

This rule detects adversary behavior where external systems or endpoints initiate connections to known malicious URLs specifically associated with executable files (EXE), indicating potential drive-by downloads or phishing campaigns designed to deploy malware. A SOC team should proactively hunt for this activity in Azure Sentinel because early identification of these high-severity EXE-tagged threats allows for immediate containment before the adversary can establish persistence or execute payload delivery within the network.

IOC Summary

Threat: exe Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: exe
let malicious_domains = dynamic(["mon-blanc-03.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["mon-blanc-03.cfd"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: exe Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently download executable installers (.exe) from trusted vendor repositories (e.g., download.microsoft.com, go.microsoft.com, or specific SaaS update servers) to push updates. These URLs often contain dynamic query parameters that URLhaus may flag as suspicious due to high entropy in the path.
  • Filter/Exclusion: Create a whitelist exclusion for known trusted source domains (e.g., *.microsoft.com, *.office365.com) and specific user agents containing “SCCM” or “IntuneAgent”. Additionally, exclude URLs where the destination file hash matches a known good baseline in your CASB solution.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled jobs (e.g., every 4 hours) to fetch the latest definition database files, which are often packaged as .exe executables. These downloads occur from high-volume CDNs that URLhaus may occasionally misclassify due to rapid content rotation.
  • Filter/Exclusion: Implement a time-based exclusion for URLs originating from specific vendor update domains (e.g., *.crowdstrike.com, *.sentinelone.net) during standard maintenance windows (02:00–04:00 local time). Alternatively, filter out alerts where the initiating process is the known AV service executable (e.g., C:\Program Files\CrowdStrike\fsqa.exe).

• Scenario: CI/CD Pipeline Artifact Downloads

  ---