URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This rule detects active attempts by adversaries to download malware payloads from known malicious URLs, indicating a potential compromise or initial access phase. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate affected endpoints before the downloaded binaries execute and establish persistence or lateral movement.

IOC Summary

Threat: malware_download Total URLs: 12 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["174.138.85.68", "42.5.227.122", "193.178.158.107", "125.41.228.123", "154.70.152.216", "60.17.117.82", "91.92.242.236", "220.201.27.9"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["174.138.85.68", "42.5.227.122", "193.178.158.107", "125.41.228.123", "154.70.152.216", "60.17.117.82", "91.92.242.236", "220.201.27.9"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific build artifact or dependency from a staging server that shares a hostname or IP with a known URLhaus entry, or a CI/CD pipeline (e.g., Jenkins, GitHub Actions) fetches a container image or binary from a registry that has been recently flagged.

  • Filter/Exclusion: Exclude source processes common to CI/CD agents (e.g., java.exe for Jenkins, node.exe for GitHub Actions) or specific user accounts tagged as svc-ci or build-service. Additionally, exclude if the destination path matches standard artifact directories like C:\Jenkins\workspace\ or /var/lib/jenkins/.

• Scenario: An endpoint protection agent (e.g., CrowdStrike Falcon, Defender for Endpoint) or a network monitoring tool (e.g., Wireshark, Zeek) performs a health check or telemetry upload to a vendor-specific update server that coincidentally matches a URLhaus pattern, or a scheduled task runs a script to verify connectivity to a backup storage endpoint.

  • Filter/Exclusion: Exclude source processes associated with known EDR agents (e.g., FalconSensor.exe, MsMpEng.exe) or backup clients (e.g., VeeamAgent.exe, RubrikAgent.exe). Also, exclude if the event is generated by a scheduled task named HealthCheck or TelemetrySync.

• Scenario: A web application server (e.g., IIS, Apache, Nginx) serves a static file or API response where the URL path contains a substring that matches a malicious URL pattern (e.g., a file named download.php on a legitimate domain), or a reverse proxy (e.g., HAProxy, Nginx) logs the full request URI which includes a query string that triggers the rule.