URLhaus: jar Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving malicious Java Archive (JAR) files distributed through compromised URLs tracked by URLhaus, which often serve as entry points for supply chain attacks or remote code execution. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected endpoints and prevent the propagation of Java-based malware that could compromise sensitive application logic before traditional signature-based defenses engage.

IOC Summary

Threat: jar Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: jar
let malicious_domains = dynamic(["kryptonclientliista.lovable.app", "www.krypton-client.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["kryptonclientliista.lovable.app", "www.krypton-client.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: jar Malicious URLs detection rule, along with targeted filtering strategies:

• Automated Java Application Updates via Package Managers

  • Scenario: Enterprise deployment tools like Ansible, Chef, or Puppet frequently pull .jar artifacts from public repositories (e.g., Maven Central, JCenter) to update internal Java-based microservices. If the URLhaus feed flags a generic repository endpoint hosting these standard libraries as “malicious,” it triggers an alert despite the traffic being legitimate build-time activity.
  • Suggested Filter: Exclude URLs containing known artifact repository domains (e.g., repo1.maven.org, jcenter.bintray.com) or filter based on the source process name matching deployment agents (ansible-runner.exe, chef-client).

• Scheduled Java-Based Backup and Reporting Jobs

  • Scenario: Internal scheduled tasks running via Windows Task Scheduler or cron execute custom Java scripts to generate daily compliance reports or backup logs. These scripts often fetch configuration templates or data feeds from internal or partner portals that host .jar resources, which may be misidentified by the URLhaus signature due to shared hosting infrastructure.
  • Suggested Filter: Create an exclusion for traffic originating from specific service accounts (e.g., DOMAIN\BackupService) during defined maintenance windows (e.g., 02:00–04:00) where these jobs are known to run.

• Development IDE and Build Tool Connectivity

  • Scenario: Developers using IntelliJ IDEA, Eclipse, or Gradle/Maven build tools continuously download dependencies and plugins from external sources during the workday. These tools often initiate connections to CDN endpoints serving .jar files that might be flagged as suspicious by the detection logic due to high frequency of new URL