URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints initiate downloads from known malicious URLs identified by URLhaus, indicating potential initial access or command and control activities via compromised web resources. Proactively hunting for these specific indicators in Azure Sentinel is critical to rapidly identify and contain malware infections before they establish persistence or exfiltrate sensitive data across the organization’s cloud infrastructure.

IOC Summary

Threat: malware_download Total URLs: 6 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["digital-magicians.com", "113.239.220.232", "27.37.101.136"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["digital-magicians.com", "113.239.220.232", "27.37.101.136"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: malware_download rule in an enterprise environment, including suggested filters and exclusions:

• Automated Patch Management Scans

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or a dedicated patch management tool (e.g., Ivanti Neurons, WSUS) performs routine vulnerability scans. These tools frequently query known software vendor repositories (like download.microsoft.com or updates.adobe.com) to check for the latest definitions and patches. URLhaus may flag these high-volume, generic download endpoints as “malware_download” due to their broad usage patterns across the internet, even when no actual malware is present on the specific enterprise host.
  • Filter/Exclusion: Create a whitelist exclusion based on the Process Name (e.g., MsMpEng.exe, CcmExec.exe) and restrict the rule trigger to only fire if the destination URL does not belong to approved vendor domains (e.g., *.microsoft.com, *.adobe.com).

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune initiates mass deployment jobs. These agents download installation packages (MSI/EXE) from internal distribution points that proxy external content or directly fetch updates from software publishers like Autodesk, Oracle, or VMware. The sheer volume of these downloads, combined with the dynamic nature of software update URLs, often triggers the “malicious URL” heuristic even though the traffic is authorized administrative activity.
  • Filter/Exclusion: Implement a filter that excludes alerts where the Source User belongs to the IT_Operations or Service_Accounts security group and the **Destination