This rule detects potential malware staging or payload delivery by identifying network traffic to known malicious URLs associated with the malware_download tag. Proactively hunting for these indicators allows the SOC team to identify compromised hosts or lateral movement attempts before the downloaded payloads execute and establish a foothold in the Azure environment.
This rule detects potential malware staging or payload delivery by identifying network traffic to known malicious URLs associated with the malware_download tag. Proactively hunting for these indicators allows the SOC team to identify compromised hosts or lateral movement attempts before the downloaded payloads execute and establish a foothold in the Azure environment.
Threat: malware_download Total URLs: 21 Active URLs: 8
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://120.84.213.251:54475/i | online | malware_download | 2026-09-04 |
hxxp://150.241.65.250:889/venv/lib/python3.12/site-packages/bcrypt/_bcrypt.abi3.so | offline | malware_download | 2026-09-04 |
hxxp://150.241.65.250:889/venv/lib64/python3.12/site-packages/cryptography/hazmat/bindings/_rust.abi3.so | offline | malware_download | 2026-09-04 |
hxxp://150.241.65.250:889/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA | offline | malware_download | 2026-09-04 |
hxxp://115.63.245.146:39613/bin.sh | offline | malware_download | 2026-09-04 |
hxxp://115.63.245.146:39613/i | offline | malware_download | 2026-09-04 |
hxxp://202.189.12.244/66666.bin | online | malware_download | 2026-09-04 |
hxxps://seobandung.site/raw/alfa.txt | offline | malware_download | 2026-09-04 |
hxxp://209.99.189.200/img_094855.png | offline | malware_download | 2026-09-04 |
hxxp://209.99.189.200/img_094254.png | offline | malware_download | 2026-09-04 |
hxxp://209.99.189.200/core_091457.iso | offline | malware_download | 2026-09-04 |
hxxp://filecon.sbs//driver.jpg | online | malware_download | 2026-09-04 |
hxxp://filecon.sbs//pas.jpg | online | malware_download | 2026-09-04 |
hxxp://filecon.sbs//bk.jpg | online | malware_download | 2026-09-04 |
hxxp://ccoffice.site//pas.jpg | offline | malware_download | 2026-09-04 |
hxxp://ccoffice.site//bk.jpg | offline | malware_download | 2026-09-04 |
hxxp://ccoffice.site//driver.jpg | offline | malware_download | 2026-09-04 |
hxxp://113.228.158.110:48412/i | offline | malware_download | 2026-09-04 |
hxxp://193.90.12.80/aminer.gz | online | malware_download | 2026-09-04 |
hxxp://123.190.28.100:58407/bin.sh | online | malware_download | 2026-09-04 |
hxxp://42.55.48.13:57019/i | online | malware_download | 2026-09-04 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["123.190.28.100", "filecon.sbs", "120.84.213.251", "202.189.12.244", "42.55.48.13", "193.90.12.80"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.190.28.100", "filecon.sbs", "120.84.213.251", "202.189.12.244", "42.55.48.13", "193.90.12.80"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
curl or wget to download a specific build artifact or dependency from a staging server that was temporarily registered in URLhaus due to a shared IP or certificate overlap.
curl/ or wget/ and the source process is bash, sh, or powershell executed by a service account with the DevOps or CI_CD group membership.ccmexec.exe, ansible-playbook, or python.exe and the destination path matches C:\Windows\CCM\ or /var/lib/ansible/.nmap, masscan, or wpscan and the user context matches the Security_Testing AD group.(.mp4, .mov, .csv, .json, .zip) and the source process is chrome.exe, edge.exe, or `