URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis targets adversary activity where endpoints or cloud workloads initiate outbound connections to known malicious URLs associated with malware staging or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets early, preventing the execution of downloaded payloads and subsequent lateral movement within the environment.

IOC Summary

Threat: malware_download Total URLs: 36 Active URLs: 29

URL	Status	Threat	Date Added
`hxxp://113.228.253.15:50802/bin.sh`	offline	malware_download	2026-09-03
`hxxp://27.215.84.25:44698/bin.sh`	offline	malware_download	2026-09-03
`hxxp://220.177.11.172:54471/i`	offline	malware_download	2026-09-03
`hxxp://175.150.74.42:43235/i`	online	malware_download	2026-09-03
`hxxp://112.248.108.140:41002/bin.sh`	online	malware_download	2026-09-03
`hxxp://37.34.242.99:41845/bin.sh`	online	malware_download	2026-09-03
`hxxp://123.189.150.115:50311/i`	online	malware_download	2026-09-03
`hxxp://113.237.54.47:52447/bin.sh`	online	malware_download	2026-09-03
`hxxp://116.138.189.67:59950/bin.sh`	online	malware_download	2026-09-03
`hxxp://60.18.8.218:39736/i`	online	malware_download	2026-09-03
`hxxp://60.23.159.201:59783/i`	online	malware_download	2026-09-03
`hxxp://202.110.2.191:50033/bin.sh`	online	malware_download	2026-09-03
`hxxp://60.18.10.146:45922/bin.sh`	online	malware_download	2026-09-03
`hxxp://42.7.139.85:48486/i`	online	malware_download	2026-09-03
`hxxp://175.174.46.121:40584/i`	online	malware_download	2026-09-03
`hxxp://60.18.8.218:39736/bin.sh`	online	malware_download	2026-09-03
`hxxp://116.2.43.97:35984/i`	online	malware_download	2026-09-03
`hxxp://217.25.229.189:54559/i`	online	malware_download	2026-09-03
`hxxp://175.147.156.105:33491/i`	online	malware_download	2026-09-03
`hxxp://60.23.72.121:51494/i`	online	malware_download	2026-09-03
`hxxp://42.54.13.17:37031/bin.sh`	online	malware_download	2026-09-03
`hxxp://43.252.159.101:46184/i`	online	malware_download	2026-09-03
`hxxp://123.188.64.71:51051/i`	online	malware_download	2026-09-03
`hxxp://175.165.84.83:51621/bin.sh`	offline	malware_download	2026-09-03
`hxxp://175.174.46.121:40584/bin.sh`	online	malware_download	2026-09-03

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["113.237.54.47", "42.52.200.244", "123.189.150.115", "60.18.10.146", "217.25.229.189", "116.2.43.97", "42.87.168.173", "42.7.139.85", "123.189.134.98", "60.23.72.121", "113.236.67.209", "42.54.13.17", "116.138.189.67", "60.18.8.218", "175.150.74.42", "37.34.242.99", "113.231.108.98", "60.23.159.201", "175.174.46.121", "43.252.159.101", "175.147.156.105", "202.110.2.191", "112.248.108.140", "123.188.64.71", "194.59.31.57"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["113.237.54.47", "42.52.200.244", "123.189.150.115", "60.18.10.146", "217.25.229.189", "116.2.43.97", "42.87.168.173", "42.7.139.85", "123.189.134.98", "60.23.72.121", "113.236.67.209", "42.54.13.17", "116.138.189.67", "60.18.8.218", "175.150.74.42", "37.34.242.99", "113.231.108.98", "60.23.159.201", "175.174.46.121", "43.252.159.101", "175.147.156.105", "202.110.2.191", "112.248.108.140", "123.188.64.71", "194.59.31.57"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to fetch a specific binary or configuration file from a staging server that has been temporarily flagged by URLhaus due to a shared IP or recent compromise, but the artifact itself is verified via checksum.
- Filter/Exclusion: Exclude alerts where the source process is a known build agent (e.g., java.exe for Jenkins, node.exe for GitHub Actions) and the destination path matches the standard build workspace directory (e.g., C:\Jenkins\workspace\* or /home/runner/work/*).
Scenario: An IT administrator manually downloads a patch or utility from a vendor’s support portal (e.g., support.vendor.com/downloads/patch_v2.1.exe) that is hosted on a CDN or subdomain recently added to URLhaus due to a widespread malware campaign using similar infrastructure.
- Filter/Exclusion: Exclude alerts where the user agent is a known enterprise browser (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0) and the file is saved to the standard Downloads folder, followed by execution from a trusted administrative account.
Scenario: A scheduled PowerShell script in a production environment pulls a daily metrics report or log archive from an internal S3 bucket or Azure Blob Storage endpoint that shares a DNS record or IP range with a known malicious URLhaus entry.
- Filter/Exclusion: Exclude alerts where the initiating process is powershell.exe or pwsh.exe and the command line contains a known scheduled task name (e.g., Get-Content or Invoke-WebRequest with a -Uri parameter