URLhaus: malware_download Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected malicious URLs are used by adversaries to download malware into the network, leveraging compromised or phishing-based delivery methods. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential malware infections before they spread laterally or exfiltrate data.

IOC Summary

Threat: malware_download Total URLs: 7 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["42.86.60.11", "125.43.224.91", "46.146.238.1", "mamigummy.com", "182.114.193.55", "115.58.85.74"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.86.60.11", "125.43.224.91", "46.146.238.1", "mamigummy.com", "182.114.193.55", "115.58.85.74"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually downloading a known malicious URL to test a sandboxed environment.
  Filter/Exclusion: Exclude URLs that match known testing or sandboxing platforms like VirusTotal, Malwarebytes Labs, or [Cuckoo Sandbox](https://www.cuckoo sandbox.org/).

• Scenario: A scheduled job is configured to fetch updates from a legitimate internal repository, which contains URLs flagged by URLhaus due to historical misuse.
  Filter/Exclusion: Exclude URLs that match internal update servers or repositories (e.g., internal-repo.example.com, updates.example.com).

• Scenario: A user is downloading a legitimate software update from a trusted vendor, but the URL is mistakenly tagged as malicious in URLhaus.
  Filter/Exclusion: Exclude URLs that match known software update domains (e.g., download.microsoft.com, download.docker.com, downloads.apache.org).

• Scenario: A security tool like CrowdStrike Falcon or Microsoft Defender ATP is configured to download payloads for signature analysis, triggering the rule.
  Filter/Exclusion: Exclude URLs that match known security tool download endpoints (e.g., falcon-apis.crowdstrike.com, defender-apis.microsoft.com).

• Scenario: A DevOps pipeline is using a CI/CD tool like Jenkins or GitLab CI to fetch dependencies from a public repository, which includes URLs flagged by URLhaus.
  Filter/Exclusion: Exclude URLs that match known CI/CD artifact repositories (e.g., `maven.org