URLhaus: Formbook Malicious URLs

Hunt Hypothesis

This detection rule identifies Formbook malware activity by monitoring outbound traffic to known malicious URLs that facilitate the exfiltration of credentials and banking data via phishing or exploit kit vectors. Proactive hunting in Azure Sentinel is critical because early identification of these command-and-control communications allows analysts to contain data theft incidents before sensitive information is fully compromised.

IOC Summary

Threat: Formbook Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Formbook
let malicious_domains = dynamic(["filedn.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["filedn.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Formbook Malicious URLs detection rule in an enterprise environment, along with targeted filters and exclusions:

• Automated Browser Telemetry & Health Checks

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically send telemetry data to their cloud management consoles. These agents often utilize generic subdomains that may share URL patterns with Formbook’s C2 infrastructure, triggering the rule when they perform routine health checks or policy updates.
  • Filter/Exclusion: Create a whitelist exclusion based on the specific User-Agent string of the EDR agent (e.g., CrowdStrike-Falcon-Sensor) and exclude traffic destined for known vendor IP ranges (e.g., 104.207.x.x or 52.96.x.x).

• Scheduled Cloud Backup & Sync Operations

  • Scenario: Scheduled backup jobs running via tools like Veeam, Rubrik, or Microsoft OneDrive for Business initiate outbound connections to cloud storage endpoints during off-hours (e.g., 02:00 – 04:00). If the backup service utilizes a URL structure similar to Formbook’s exfiltration patterns, these routine data transfers can be flagged as suspicious credential exfiltration.
  • Filter/Exclusion: Implement a time-based filter that suppresses alerts for this rule during defined maintenance windows (e.g., 02:00-05:00 UTC) specifically for traffic originating from the backup server group or destined to known SaaS storage domains (e.g., *.veeam.com, *.onedrive.live).

• Third-Party HR & Onboarding Portal Access

  • Scenario: During new hire