URLhaus: HypeAgent Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity where endpoints interact with malicious URLs identified by URLhaus as part of the HypeAgent campaign, which often targets financial and enterprise sectors through phishing or drive-by downloads. The SOC team should proactively investigate these interactions in Azure Sentinel to identify early-stage compromises and prevent potential lateral movement or data exfiltration associated with this specific threat actor’s infrastructure.

IOC Summary

Threat: HypeAgent Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: HypeAgent
let malicious_domains = dynamic(["files.catbox.moe", "lavos.life"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["files.catbox.moe", "lavos.life"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: HypeAgent Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne perform periodic outbound connectivity checks. These agents often query threat intelligence feeds or update their cloud connectors, which may generate traffic to URLs that HypeAgent has flagged as suspicious due to shared infrastructure or recent campaign activity.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., C:\Program Files\CrowdStrike\fs_qr.exe) and User Account (e.g., SYSTEM or specific service accounts like svc-edr-updater). Exclude these processes from triggering this specific URLhaus alert.

• Scenario: Scheduled Backup and Cloud Sync Operations

  • Context: Enterprise backup solutions such as Veeam Backup & Replication, Rubrik, or cloud synchronization tools like OneDrive for Business and SharePoint Online execute scheduled jobs during business hours. These tools frequently access external storage endpoints or metadata services that HypeAgent may have tagged due to high-volume traffic patterns resembling the HypeAgent campaign’s behavior.
  • Filter/Exclusion: Implement a filter excluding URLs containing specific backup domains (e.g., *.veeam.com, *.office365.com) when initiated by known backup service accounts (e.g., svc-backup-admin). Additionally, exclude traffic occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) for these specific processes.

• Scenario: Third-Party SaaS Integration Webhooks