URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversaries who distribute malware by directing users to download files from known malicious web endpoints identified in the URLhaus threat intelligence feed. Proactively hunting for these specific indicators within Azure Sentinel is critical to rapidly identify and isolate compromised hosts before they execute payloads that could lead to broader lateral movement or data exfiltration.

IOC Summary

Threat: malware_download Total URLs: 12 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["42.229.221.175", "42.178.60.31", "119.116.131.31", "182.116.10.155", "112.248.245.229", "222.138.102.72", "110.37.31.182", "123.188.79.78"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.229.221.175", "42.178.60.31", "119.116.131.31", "182.116.10.155", "112.248.245.229", "222.138.102.72", "110.37.31.182", "123.188.79.78"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: malware_download rule in an enterprise environment, along with targeted filtering strategies:

• Software Deployment via SCCM/Intune

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Intune agent on endpoints automatically downloads large update packages or application installers from the vendor’s official CDN. These files are often hosted on dynamic subdomains that may not yet be fully whitelisted in URLhaus but are trusted by the organization, triggering a “malware_download” alert due to high traffic volume or new hash signatures.
  • Filter/Exclusion: Exclude source IPs belonging to the internal SCCM site server and Intune management service endpoints (e.g., *.microsoft.com, specific CDN IP ranges) from the detection scope for the malware_download tag, provided the destination port is 443 and the user context is a system account (NT AUTHORITY\SYSTEM).

• Automated Patch Management Scans

  • Scenario: Scheduled nightly jobs running tools like Qualys, Tenable Nessus, or SolarWinds Patch Manager initiate background scans to fetch vulnerability definitions and patch metadata. These agents frequently query external repositories (e.g., updates.qualys.com, cdn.solarwinds.com) which may be flagged by URLhaus as “malware_download” due to the nature of the payload being executable or archive files, despite being legitimate management traffic.
  • Filter/Exclusion: Create a rule exclusion for known service accounts (e.g., svc_qualys_agent, svc_tenable) accessing specific FQDNs associated with patch management vendors. Additionally, filter out alerts where the HTTP User-Agent header contains strings like “QualysGuard”, “TenableNessus”, or “SolarWinds-Scanner”.

• **IT Admin Manual Driver/Firmware