URLhaus: Formbook Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving malicious URLs associated with the Formbook campaign, which are known to deliver targeted phishing or malware payloads via compromised web links. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected endpoints and prevent potential data exfiltration or lateral movement before broader network compromise occurs.

IOC Summary

Threat: Formbook Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Formbook
let malicious_domains = dynamic(["wylkpznq.xyz", "somostask.co"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["wylkpznq.xyz", "somostask.co"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Formbook Malicious URLs detection rule, including tailored filters and exclusions:

• Scheduled Backup Jobs to Cloud Storage Gateways

  • Scenario: Automated backup agents (e.g., Veeam, Commvault) or cloud sync tools (e.g., OneDrive for Business, Box) frequently initiate connections to Formbook-protected endpoints during off-hours to upload large datasets. These legitimate traffic patterns often mimic the URL structure of Formbook phishing campaigns.
  • Filter/Exclusion: Exclude traffic originating from specific backup service accounts or IP ranges known to host the backup agents (e.g., Source_IP IN [10.50.20.0/24] AND User_Agent CONTAINS "VeeamBackupAgent").

• Third-Party HR and Onboarding Portals

  • Scenario: The enterprise utilizes an external HR platform (e.g., Workday, BambooHR) that integrates Formbook for new hire document collection or benefits enrollment. When employees access these specific forms to upload tax documents or sign contracts, the detection logic triggers on the underlying URL structure.
  • Filter/Exclusion: Create a whitelist exclusion for the known domain of the HR provider (e.g., Destination_Domain IN ["*.workday.com", "*.bamboohr.net"]) and restrict the rule to only alert if the user is not part of the “HR_Admin” or “Onboarding_Staff” security groups.

• DevOps CI/CD Pipeline Artifact Downloads

  • Scenario: Continuous Integration servers (e.g., Jenkins, GitLab Runner) running nightly build jobs often download dependencies or configuration manifests from Formbook-hosted repositories. These automated service accounts generate high-volume requests that match the malicious URL signature but are part of standard deployment workflows.