URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints initiate downloads from known malicious URLs identified by URLhaus, indicating a potential initial access or command and control phase of an attack. Proactively hunting for these specific malware_download indicators in Azure Sentinel is critical to rapidly isolate compromised assets before the downloaded payloads can execute and establish persistence within the network.

IOC Summary

Threat: malware_download Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["116.139.183.228", "202.1.26.13", "175.146.227.235"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["116.139.183.228", "202.1.26.13", "175.146.227.235"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Software Update Agents: Legitimate endpoint management tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Jamf Pro frequently download update packages from vendor repositories that may be flagged as “malware_download” due to the sheer volume of executable payloads.

  • Suggested Filter: Exclude traffic originating from known internal IP ranges assigned to patch management servers or exclude specific destination domains (e.g., *.microsoft.com, updates.jamfsoftware.com) when the user agent string contains identifiers for these agents (e.g., CCMExec, JamfProAgent).

• Scheduled Backup and Archive Jobs: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often download large metadata files, configuration scripts, or temporary archive chunks from cloud storage endpoints. These downloads can trigger the rule if the destination URL is categorized broadly under software distribution.

  • Suggested Filter: Create an exclusion for traffic occurring during defined maintenance windows (e.g., 02:00–06:00) originating from backup service accounts or specific hostnames, targeting known cloud storage endpoints like *.blob.core.windows.net or *.s3.amazonaws.com.

• IT Administration and Patch Deployment: System administrators using tools like Ansible, Chef, or Puppet often execute scheduled jobs that pull configuration manifests, new agent binaries, or security policy definitions from internal artifact repositories (e.g., Nexus Repository Manager or Artifactory) which may be hosted on public-facing URLs.

  • Suggested Filter: Exclude traffic where the source user is a service account (e.g., svc_ansible, admin_puppet) and the destination URL