URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversaries who distribute malware by directing users to download files from newly identified malicious URLs flagged by URLhaus. Proactively hunting for these specific indicators in Azure Sentinel is critical to intercept early-stage infection vectors before they propagate across the enterprise network and compromise sensitive assets.

IOC Summary

Threat: malware_download Total URLs: 6 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["175.150.177.126", "42.59.235.202", "58.208.16.203"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["175.150.177.126", "42.59.235.202", "58.208.16.203"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Automated Software Deployment via Configuration Management Tools

  • Context: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Ansible frequently download installer packages from trusted vendor repositories (e.g., Adobe, Microsoft Update) that URLhaus may flag as “malware_download” due to the high volume of executable downloads.
  • Filter/Exclusion: Create an exclusion rule for source IPs belonging to internal deployment servers and specific destination domains known for legitimate software distribution (e.g., *.microsoft.com, *.adobe.com). Additionally, filter out events where the user context is a service account (e.g., DOMAIN\SCCM-Service) rather than an interactive user.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites such as CrowdStrike Falcon, Symantec Endpoint Protection, or Carbon Black run scheduled jobs to pull the latest malware definition signatures and engine updates from their cloud repositories, which often trigger this rule due to the nature of the payload.
  • Filter/Exclusion: Exclude traffic originating from known security vendor update servers (e.g., *.crowdstrike.com, *.symantec.com) during specific maintenance windows (e.g., 02:00–04:00 local time). Alternatively, filter by process name to exclude the specific updater executable (e.g., FalconSensor.exe or SymantecEngineUpdate.exe).

• Scenario: Cloud Backup and Synchronization Agents

  • Context: Data protection agents like Veeam, Rubrik, or Microsoft OneDrive for Business perform routine synchronization tasks that involve downloading large metadata files, logs, or backup manifests from cloud storage endpoints, which can be misclassified as malicious downloads.
  • Filter/Exclusion: Implement a filter based on the