URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries who embed known malicious download URLs in phishing lures or web pages to deliver initial payloads, a common tactic for establishing a foothold in the environment. Proactively hunting for these specific URLhaus entries in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious user activity before the malware executes, reducing the mean time to detect and contain potential breaches.

IOC Summary

Threat: malware_download Total URLs: 7 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["129.159.135.190", "92.119.167.102"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.159.135.190", "92.119.167.102"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific build artifact or dependency package from a staging CDN that shares a similar domain structure or IP range with the known malicious URL, often triggered by a CI/CD pipeline job (e.g., Jenkins or GitLab CI) running as a service account.

  • Filter/Exclusion: Exclude source processes matching curl.exe, wget.exe, or python.exe when the destination URL matches the specific malware_download hash or domain, provided the source user is part of the DevOps-Team security group.

• Scenario: An IT administrator performs a manual software deployment or patch verification by downloading a specific installer or configuration file from a vendor’s support portal or internal file share that has been temporarily mirrored to a public URL for testing purposes, using PowerShell or certutil.

  • Filter/Exclusion: Exclude events where the source process is powershell.exe or certutil.exe and the initiating user belongs to the IT-Admins group, specifically when the URL contains the vendor’s known subdomain (e.g., support.vendor.com) rather than the raw malicious IP.

• Scenario: A scheduled maintenance job (e.g., a Windows Task Scheduler task named DailyBackupSync) executes a script that fetches a checksum or metadata file from a cloud storage bucket (like S3 or Azure Blob) that has a URL pattern coincidentally matching one of the 7 malicious URLs due to a temporary DNS alias or CDN edge node.

  • Filter/Exclusion: Exclude events where the source process is cmd.exe or pwsh.exe and the parent process is TaskScheduler.exe or svchost.exe, specifically when the URL ends with a known cloud storage suffix (e.g., .blob.core.windows.net or `.