URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints initiate downloads from a curated set of 29 known malicious URLs specifically associated with malware distribution campaigns. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage infections and block lateral movement before the downloaded payloads execute within the organization’s network.

IOC Summary

Threat: malware_download Total URLs: 29 Active URLs: 0

URL	Status	Threat	Date Added
`hxxp://85.11.167.200/n2/mossad.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bin/sora.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/hiddenbin/nerv.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bins/main.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bins/bot.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bot.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bin/nerv.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bin/bot.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bins/nerv.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/kia.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/kimwolf.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/hiddenbin/ducky.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bins/aisuru.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bin/main.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/ducky.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bins/mossad.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/kia.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bins/sora.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/hiddenbin/aisuru.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/hiddenbin/boatnet.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/hiddenbin/kia.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bin/mossad.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bins/sorrow.x86_64`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/bin/kia.x86`	offline	malware_download	2026-06-28
`hxxp://85.11.167.200/tadashi.x86_64`	offline	malware_download	2026-06-28

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["85.11.167.200"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["85.11.167.200"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, along with suggested filters and exclusions:

Automated Patch Management Scans
- Scenario: Endpoint protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or patch management tools (e.g., Ivanti Neurons, ManageEngine Patch Manager Plus) periodically scan their own repositories or vendor update servers. These scans often generate HTTP requests to known software distribution URLs that URLhaus may flag as “malware_download” due to high traffic volume or recent signature updates, even though the content is benign.
- Filter/Exclusion: Create an exclusion for source IPs belonging to the internal patch management server group and destination domains ending in vendor-specific CDNs (e.g., *.microsoft.com, *.crowdstrike.com). Additionally, filter out traffic where the User-Agent string contains “Ivanti” or “Defender”.
Scheduled Software Deployment Jobs
- Scenario: Scheduled tasks running via Microsoft System Center Configuration Manager (SCCM) or Ansible Tower initiate bulk downloads of application installers and configuration scripts from internal file shares mirrored to external sources. These jobs often trigger the rule when downloading large artifacts from trusted third-party repositories (e.g., GitHub Releases, Docker Hub) that URLhaus has temporarily flagged due to a new malware variant in the same domain namespace.
- Filter/Exclusion: Exclude traffic originating from specific service accounts used by deployment tools (e.g., svc-sccm-deploy, ansible-runner) and restrict the rule to only trigger on user-initiated browser sessions, excluding background service ports (e.g., exclude destination ports other than 80/443 if the tool uses custom ports).
IT Helpdesk Remote Support Sessions