URLhaus: exe Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where external systems or users access malicious executable files hosted on suspicious URLs flagged by URLhaus, indicating potential drive-by downloads or phishing campaigns targeting Windows environments. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent the execution of unknown malware before it establishes persistence or exfiltrates sensitive data.

IOC Summary

Threat: exe Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: exe
let malicious_domains = dynamic(["tmcksa.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["tmcksa.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: exe Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently download .exe installers from internal distribution points or public vendor repositories (e.g., Adobe, Zoom, Office 365 updates). These legitimate downloads often match the “malicious URL” signature because they involve executable payloads being fetched over HTTPS.
  • Suggested Filter/Exclusion: Create an exclusion based on the source IP range of internal distribution points or specific trusted vendor domains (e.g., *.office.com, *.zoom.us). Additionally, filter out events where the initiating process is ccmsetup.exe or IntuneManagementExtension.exe.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint run scheduled jobs to fetch definition updates. These jobs often download .exe packages containing the latest virus definitions from vendor update servers, which can trigger the rule due to the executable nature of the payload URL.
  • Suggested Filter/Exclusion: Exclude events where the parent process is DefenderService.exe, FalconSensor.exe, or LiveUpdate.exe. Implement a time-based exclusion for known maintenance windows (e.g., 02:00–04:00 UTC) when these automated updates typically occur.

• Scenario: Legacy Line-of-Business (LOB) Application Auto-Updates

  • Context: Custom internal applications or legacy ERP systems often utilize a specific .exe launcher to check for and download patches from an on-premise file server or a dedicated update portal. These URLs are static and trusted