URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the URLhaus malware_download family to establish command-and-control channels for data exfiltration or secondary payload deployment. Proactively hunting for these specific malicious URLs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the full execution of the downloader and subsequent lateral movement within the environment.

IOC Summary

Threat: malware_download Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["42.225.218.136", "115.60.223.220"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.225.218.136", "115.60.223.220"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Update Checks: Older line-of-business applications (e.g., Java-based enterprise tools or specific POS systems) may perform periodic HTTP/HTTPS checks against known vendor update servers or license validation endpoints that are listed on URLhaus due to historical compromises or shared IP ranges.
  • Filter/Exclusion: Exclude known vendor update domains (e.g., *.java.com, *.oracle.com) or specific legacy application process names (e.g., java.exe, pos_service.exe) when the destination URL matches a verified vendor certificate or known IP range.
• CI/CD Pipeline Artifact Downloads: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, GitLab Runner, Azure DevOps) frequently download build artifacts, container images, or dependency packages from internal artifact repositories (Nexus, Artifactory) or public registries (Docker Hub, PyPI, npm) that may be flagged by URLhaus if the registry host has a known vulnerability or is used for staging malicious payloads in other contexts.
  • Filter/Exclusion: Exclude processes associated with CI/CD agents (e.g., jenkins-agent, gitlab-runner, azure-devops-agent) and internal artifact repository domains (e.g., nexus.internal.corp, registry-1.docker.io) if the download occurs over a trusted internal network segment or via a verified service account.
• Software License Validation and Telemetry: Commercial software suites (e.g., Adobe Creative Cloud, Microsoft Office, SAP modules) perform regular license validation and telemetry uploads to vendor servers. These endpoints may appear in URLhaus databases due to past incidents or because they serve as common C2 channels for other malware families, leading to false positives for legitimate telemetry.
  • Filter/Exclusion: Exclude known vendor telemetry and license validation domains (e.g., *.adobe.com, `*.microsoft.com