URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversaries leveraging known malicious URLs to initiate malware downloads, a tactic often used in initial access or execution phases of an attack chain. Proactively hunting for these specific URL patterns within Azure Sentinel enables the SOC team to rapidly isolate compromised endpoints and block lateral movement before the malware fully establishes persistence on the network.

IOC Summary

Threat: malware_download Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["125.42.33.214", "119.185.242.125"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.42.33.214", "119.185.242.125"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: malware_download rule, along with targeted filtering strategies suitable for an enterprise environment:

• Scenario: Automated Endpoint Protection Updates

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates and threat intelligence feeds from vendor-specific URLs. These downloads often contain executable payloads that URLhaus may flag as malware_download due to the nature of the content (installers or update scripts).
  • Filter/Exclusion: Create a whitelist exclusion based on the source hostname and user context. Exclude traffic where the source_user is a service account (e.g., svc-crowdstrike, defender-agent) AND the destination domain matches known vendor domains (e.g., *.crowdstrike.com, *.update.microsoft.com).

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune often pushes software patches and new application installers to endpoints during maintenance windows. These deployments involve downloading large .msi or .exe files from internal distribution points or public repositories, which can trigger the rule if the URL is newly registered in the threat feed.
  • Filter/Exclusion: Implement a time-based exclusion combined with process filtering. Exclude alerts where the process_name corresponds to deployment agents (e.g., ccmsetup.exe, IntuneManagementExtension.exe) AND the event occurs within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Admin Manual Tool Downloads

  • Context: IT administrators frequently download diagnostic tools, configuration scripts, or utility software from trusted vendor portals (e.g., downloading a specific version of Wireshark, PowerShell modules,