URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversaries who are actively distributing malware by directing users to download payloads from newly identified malicious URLs flagged by URLhaus. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of these download behaviors allows the SOC team to isolate compromised endpoints before widespread infection occurs across the organization.

IOC Summary

Threat: malware_download Total URLs: 4 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["182.113.31.70", "116.140.173.225"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.113.31.70", "116.140.173.225"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Definition Updates via Central Management Console

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec) automatically downloads the latest virus definition packages from a vendor’s update server. These large binary downloads often trigger URLhaus signatures due to the high volume of executable content and frequent changes in hash values associated with daily updates.
  • Filter/Exclusion: Create an exclusion rule targeting traffic destined for known vendor update domains (e.g., *.crowdstrike.com, go.microsoft.com, .symantec.com) specifically on ports 443, where the User-Agent string contains the specific AV agent name and the file extension is .cab, .msi, or .exe.

• Automated Software Deployment via Configuration Management Tools

  • Scenario: Scheduled tasks executed by configuration management tools (e.g., Ansible, SCCM/MECM, or Puppet) pull application installers or patch bundles from internal artifact repositories (like Artifactory or Nexus) that mirror external sources. If the repository mirrors a URLhaus-listed domain for software distribution, legitimate deployment jobs downloading new versions of enterprise applications will trigger alerts.
  • Filter/Exclusion: Exclude traffic originating from specific service accounts or IP ranges dedicated to configuration management servers (e.g., svc-ansible-deploy, SCCM-DP01) accessing internal artifact repository URLs that are known mirrors of trusted software vendors.

• IT Helpdesk Remote Support Sessions

  • Scenario: IT administrators initiate remote support sessions using tools like TeamViewer, AnyDesk, or Splashtop to troubleshoot user workstations. During these sessions, the admin may download a