URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries who leverage known malicious URLs to download and execute payloads, a common initial access or post-compromise technique that can lead to persistent footholds within the environment. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised assets or suspicious outbound traffic before the malware fully establishes itself, reducing the mean time to detect and contain high-severity threats.

IOC Summary

Threat: malware_download Total URLs: 11 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["115.55.54.214", "115.63.36.25", "qqwwaa.tos-cn-hongkong.volces.com", "qdzip-1476850762.cos.ap-singapore.myqcloud.com", "42.58.252.119", "42.7.238.65"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.55.54.214", "115.63.36.25", "qqwwaa.tos-cn-hongkong.volces.com", "qdzip-1476850762.cos.ap-singapore.myqcloud.com", "42.58.252.119", "42.7.238.65"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps team uses curl or wget in a CI/CD pipeline (e.g., GitHub Actions, Jenkins) to download a specific version of a build artifact or dependency from a staging server that shares the same IP/URL structure as the known malicious URL.
  • Filter/Exclusion: Exclude source processes matching curl.exe, wget.exe, or powershell.exe when the parent process is a known CI/CD agent (e.g., agent.exe, jenkins-agent.jar) or when the user account is a service account (e.g., svc-ci-cd).
• Scenario: An endpoint protection agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or a backup solution (e.g., Veeam, Commvault) downloads a definition update, plugin, or agent binary from a vendor’s distribution server that happens to be hosted on the same domain or IP as the malicious URL.
  • Filter/Exclusion: Exclude processes known to be vendor agents (e.g., FalconSensor.exe, MsMpEng.exe, VeeamBackup.exe) and exclude network connections where the destination port is 443 and the source process is signed by the vendor’s certificate.
• Scenario: A security team runs a manual threat hunt or validation script using PowerShell or Python to test the detection rule by fetching the malicious URL to confirm the alert fires, often in a controlled lab or on a single test host.
  • Filter/Exclusion: Exclude hosts tagged as Lab or Test in the asset inventory, or exclude events where the user account is a dedicated security analyst account (e.g., sec-analyst-01) and the process is powershell.exe or python.exe with a command line containing the specific URL.