URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints initiate downloads from known malicious URLs flagged by URLhaus, indicating potential initial access or command-and-control activity involving malware distribution. A proactive hunt is essential in Azure Sentinel to rapidly isolate affected systems and prevent lateral movement before the downloaded payloads execute within the network environment.

IOC Summary

Threat: malware_download Total URLs: 45 Active URLs: 34

URL	Status	Threat	Date Added
`hxxp://60.21.174.229:40485/i`	online	malware_download	2026-08-15
`hxxp://60.21.174.229:40485/bin.sh`	online	malware_download	2026-08-15
`hxxp://59.58.42.29:40746/bin.sh`	offline	malware_download	2026-08-15
`hxxp://182.116.113.206:54138/bin.sh`	offline	malware_download	2026-08-15
`hxxp://182.126.213.104:40820/bin.sh`	offline	malware_download	2026-08-15
`hxxp://113.239.64.220:36469/i`	offline	malware_download	2026-08-15
`hxxp://123.185.91.133:52353/i`	offline	malware_download	2026-08-15
`hxxp://163.142.95.26:40959/bin.sh`	online	malware_download	2026-08-15
`hxxp://196.190.105.170:60232/bin.sh`	offline	malware_download	2026-08-15
`hxxp://221.15.14.56:52752/bin.sh`	online	malware_download	2026-08-15
`hxxp://124.94.194.151:60883/bin.sh`	online	malware_download	2026-08-15
`hxxp://116.2.53.55:45559/i`	online	malware_download	2026-08-15
`hxxp://120.84.214.125:39910/i`	online	malware_download	2026-08-15
`hxxp://42.179.125.40:42620/i`	online	malware_download	2026-08-15
`hxxp://119.116.142.166:55362/i`	online	malware_download	2026-08-15
`hxxp://123.189.159.141:53442/i`	online	malware_download	2026-08-15
`hxxp://42.85.15.27:60468/i`	online	malware_download	2026-08-15
`hxxp://163.142.77.145:55241/bin.sh`	offline	malware_download	2026-08-15
`hxxp://42.4.250.38:55169/bin.sh`	online	malware_download	2026-08-15
`hxxp://175.148.111.17:57080/bin.sh`	online	malware_download	2026-08-15
`hxxp://175.148.111.17:57080/i`	online	malware_download	2026-08-15
`hxxp://37.34.242.96:52648/i`	online	malware_download	2026-08-15
`hxxp://42.233.94.20:34018/i`	offline	malware_download	2026-08-15
`hxxp://74.127.168.68:33881/i`	online	malware_download	2026-08-15
`hxxp://42.4.250.38:55169/i`	online	malware_download	2026-08-15

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["60.21.174.229", "120.84.214.125", "163.142.95.26", "123.189.159.141", "42.85.15.27", "119.116.142.166", "124.94.194.151", "42.231.64.252", "175.148.111.17", "175.146.231.101", "116.2.53.55", "37.34.242.96", "110.36.1.200", "175.149.87.101", "42.4.250.38", "221.15.14.56", "42.179.125.40", "185.141.233.178", "74.127.168.68", "222.136.169.228", "163.142.77.145"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["60.21.174.229", "120.84.214.125", "163.142.95.26", "123.189.159.141", "42.85.15.27", "119.116.142.166", "124.94.194.151", "42.231.64.252", "175.148.111.17", "175.146.231.101", "116.2.53.55", "37.34.242.96", "110.36.1.200", "175.149.87.101", "42.4.250.38", "221.15.14.56", "42.179.125.40", "185.141.233.178", "74.127.168.68", "222.136.169.228", "163.142.77.145"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: malware_download Malicious URLs detection rule:

Scenario: Automated Security Tool Updates
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or vulnerability scanners (e.g., Qualys Cloud Agent) frequently download signature updates and definition files from vendor-specific update servers. These URLs are often newly registered or dynamically generated, causing URLhaus to flag them as potential malware_download threats before they are fully whitelisted in the threat intelligence feed.
- Filter/Exclusion: Exclude traffic originating from known internal update servers (e.g., *.crowdstrike.com, *.microsoft.com) or specific hostnames used by security agents. Alternatively, create a filter to ignore alerts where the destination URL contains standard update paths like /updates/ or /definitions/.
Scenario: Scheduled Admin Script Execution
- Context: System administrators often deploy scheduled PowerShell scripts or Python automation jobs (via Task Scheduler or Ansible) that fetch configuration manifests, license keys, or patch metadata from internal repositories or public CDNs. If these scripts download a file from a URL recently flagged by URLhaus due to global noise, the rule triggers a false positive despite the content being benign and verified by the admin team.
- Filter/Exclusion: Implement an exclusion based on the initiating process name (e.g., powershell.exe, python.exe) combined with a specific user context (e.g., domain accounts prefixed with ADM_ or SVC_). Additionally, exclude URLs that resolve to internal IP ranges or trusted CDN domains like *.cloudfront.net.
Scenario: Third-Party SaaS Integration Sync
- Context: Business applications such as CRM (Salesforce), HRIS (Workday), or collaboration tools (