URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints initiate downloads from URLs identified by URLhaus as hosting active malware payloads. A SOC team should proactively hunt for this in Azure Sentinel to rapidly isolate compromised systems and prevent lateral movement before malicious executables are fully established on the network.

IOC Summary

Threat: malware_download Total URLs: 9 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["38.76.206.4", "123.14.189.81", "long-wildflower-b4f5.gustavosoftware.workers.dev", "112.248.186.110", "sumiko.vu", "209.54.103.153"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["38.76.206.4", "123.14.189.81", "long-wildflower-b4f5.gustavosoftware.workers.dev", "112.248.186.110", "sumiko.vu", "209.54.103.153"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the URLhaus: malware_download Malicious URLs detection rule:

• Scenario: Automated Software Update Scans by Endpoint Protection Agents

  • Context: Enterprise endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black frequently query URLhaus feeds directly to verify the reputation of update packages before downloading them. These queries often hit the malware_download tag even when the actual download is benign, as the agent is performing a pre-check on a known repository link.
  • Filter/Exclusion: Exclude traffic where the source process name matches specific EDR agents (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Windows\System32\DefenderSvc.exe) AND the destination URL contains known update domains such as *.microsoft.com/update or *.crowdstrike.com.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated backup solutions like Veeam Backup & Replication, Rubrik, or Commvault often download metadata, configuration snapshots, or small delta files from cloud repositories. These jobs run on a strict schedule (e.g., nightly at 02:00) and may interact with URLs that URLhaus has flagged as malware_download due to the nature of the file type (e.g., .zip, .tar) rather than actual malware presence.
  • Filter/Exclusion: Create a time-based exclusion for scheduled jobs running between 01:00 and 05:00 local time, filtering out events where the source process is Veeam.Backup.Service.exe or rubrik-agent, provided the HTTP status code is 200 OK.

• Scenario: Admin-Driven Patch Management Deployments