URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints download files from known malicious URLs flagged by URLhaus as containing malware, indicating potential initial access or payload delivery attempts. Proactive hunting in Azure Sentinel is critical to rapidly isolate compromised hosts and prevent lateral movement before the downloaded malware executes within the network environment.

IOC Summary

Threat: malware_download Total URLs: 6 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["42.231.203.243", "182.120.13.196"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.231.203.243", "182.120.13.196"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download detection rule, along with targeted filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Antivirus Definition Updates via Cloud Repositories

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, frequently query cloud-based update servers to download the latest malware definition signatures. These downloads often originate from high-volume URLs that URLhaus may flag due to their dynamic nature or shared IP ranges used by multiple vendors.
  • Filter/Exclusion: Create a whitelist exclusion based on specific destination domains (e.g., *.crowdstrike.com, *.microsoft.com) and restrict the rule trigger to exclude traffic from known EDR management servers. Additionally, filter out events where the user agent string contains keywords like “FalconSensor” or “DefenderService”.

• Scenario: Scheduled Backup Jobs Downloading Large Archives

  • Context: Automated backup solutions like Veeam Backup & Replication or Rubrik often initiate scheduled jobs during off-hours to download large configuration files, logs, or incremental backups from cloud storage providers (e.g., AWS S3, Azure Blob). These URLs can be dynamically generated with long query parameters that URLhaus interprets as suspicious “malware_download” patterns.
  • Filter/Exclusion: Implement a time-based exclusion window for these specific backup service accounts (e.g., exclude triggers between 02:00 and 06:00 UTC). Alternatively, filter by the source process name (vrb.exe, rubrik-agent) to ensure only interactive user downloads trigger the alert.

• Scenario: Software Deployment via Configuration Management Tools

  • Context: IT Operations teams use tools like **Microsoft Endpoint Configuration Manager (MECM/