URLhaus: Formbook Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the Formbook malware family to establish initial access or execute payloads via known malicious URLs, often used for downloading additional components or establishing command-and-control channels. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or user sessions that have interacted with these URLs, enabling rapid containment before the malware can propagate or exfiltrate data.

IOC Summary

Threat: Formbook Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Formbook
let malicious_domains = dynamic(["216.9.224.48"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["216.9.224.48"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A legacy internal application or custom script uses a hardcoded URL for a temporary file upload endpoint that was previously compromised and later cleaned, but the URL remains in the codebase or configuration files (e.g., http://192.168.10.5/tmp/upload.php).

  • Filter/Exclusion: Exclude URLs matching the specific internal IP range (e.g., 192.168.10.0/24) or add the specific known-good internal host to the exclusion list if the URL is confirmed benign via DNS resolution and traffic inspection.

• Scenario: A scheduled PowerShell job or batch script used by the DevOps team for testing purposes references a staging environment URL that was temporarily hosted on a compromised server during a recent incident, but the script has not yet been updated to point to the new production endpoint.

  • Filter/Exclusion: Exclude URLs containing the staging subdomain (e.g., staging-internal.corp.com) or create a specific exclusion for the known staging host IP if it is isolated and not directly accessible from the production network segment.

• Scenario: A third-party SaaS integration (e.g., a CRM or HR tool) sends webhook notifications to a callback URL that was temporarily misconfigured to point to a known Formbook URL during a migration, but the traffic is still being logged in historical data or replayed in test environments.

  • Filter/Exclusion: Exclude URLs associated with the specific SaaS provider’s known callback domains (e.g., webhooks.salesforce.com or api.hubspot.com) if the Formbook URL is a temporary alias, or filter out events where the source process is a known SaaS agent (e.g., SalesforceAgent.exe).

• Scenario: A developer’s local machine or a CI/CD runner in a non-production environment