URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging known malicious URLs to initiate malware downloads onto user endpoints, a common initial access vector that often bypasses standard perimeter defenses. Proactively hunting for these specific URLhaus-tagged indicators in Azure Sentinel is critical to identify early-stage compromise and prevent the lateral spread of downloaded payloads before they execute within the environment.

IOC Summary

Threat: malware_download Total URLs: 9 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["103.68.95.197", "61.137.204.83", "27.44.145.84", "42.178.45.124"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.68.95.197", "61.137.204.83", "27.44.145.84", "42.178.45.124"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: malware_download detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Antivirus Endpoint Definition Updates

  • Scenario: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) automatically download definition updates or threat intelligence feeds from vendor-specific URLs that may be flagged as malware_download due to high entropy in the payload or shared hosting infrastructure.
  • Filter/Exclusion: Exclude traffic originating from known AV update domains (e.g., *.microsoft.com, *.crowdstrike.com) where the user agent string contains “Antivirus” or specific service accounts like AV-Update-Svc.

• Scheduled Software Patching and Deployment

  • Scenario: Automated deployment tools such as SCCM, Intune, or Ansible execute scheduled jobs to download installer packages (MSI/EXE) from internal artifact repositories or public CDNs. These downloads often trigger the rule because they involve large binary files being fetched via HTTPS.
  • Filter/Exclusion: Create an exclusion for traffic initiated by service accounts named Patch-Deployer or Intune-AutoUpdate accessing specific internal repository domains (e.g., *.artifacts.internal.corp) during maintenance windows (e.g., 01:00–05:00).

• Cloud Backup and Data Archiving Jobs

  • Scenario: Cloud backup agents (e.g., Veeam, Rubrik, or Azure Backup) periodically download metadata manifests or incremental block files from cloud storage endpoints. The nature of these downloads often mimics the signature of a malware download event due to the file type and source URL structure.
  • Filter/Exclusion: Filter out alerts where the destination port is 443 and the source process