URLhaus: malware Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known malicious URLs from the URLhaus feed, indicating potential web-based delivery mechanisms or compromised endpoints actively communicating with malicious infrastructure. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage intrusions or lateral movement attempts before they escalate into full-blown breaches.

IOC Summary

Threat: malware Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware
let malicious_domains = dynamic(["tapped.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["tapped.top"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to download a specific build artifact or dependency from a staging repository that has been temporarily flagged by URLhaus due to a shared IP or domain collision with a known malware campaign.

  • Filter/Exclusion: Exclude URLs originating from internal staging domains (e.g., *.staging.internal.corp) or specific CI/CD service endpoints (e.g., *.githubusercontent.com, *.jfrog.io) when the source IP is within the corporate DMZ or trusted internal ranges.

• Scenario: A security team conducts a controlled phishing simulation or red team exercise where benign landing pages are hosted on a public domain that URLhaus has recently tagged as “malware” due to its association with a known kit (e.g., GoPhish or Evilginx2 infrastructure).

  • Filter/Exclusion: Create an allowlist for known internal simulation domains (e.g., phish-sim.corp.com) or exclude events where the user agent string contains a custom tag (e.g., X-Sim-Tag: true) or where the source account is a dedicated “Red Team” service account.

• Scenario: An application server fetches a third-party API or CDN resource (e.g., a JavaScript library from a public CDN like cdn.jsdelivr.net or unpkg.com) that has been compromised or misconfigured, causing URLhaus to tag the specific path as malicious, even though the root domain is trusted.

  • Filter/Exclusion: Exclude URLs from known public CDN domains (e.g., *.jsdelivr.net, *.unpkg.com, *.cloudflare.com) if the request originates from application service accounts (e.g., svc-app-server) and the HTTP status code is 200, indicating a successful fetch rather than a