URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints initiate downloads from known malicious URLs identified by URLhaus, indicating potential initial access or execution of malware payloads. Proactively hunting for these specific indicators in Azure Sentinel is critical to rapidly identify and contain early-stage infections before they establish persistence or spread laterally across the organization’s cloud infrastructure.

IOC Summary

Threat: malware_download Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["misty-cherry-cea3.uploadsimg.workers.dev", "sesaddf.kesug.com", "123.11.10.128"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["misty-cherry-cea3.uploadsimg.workers.dev", "sesaddf.kesug.com", "123.11.10.128"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Policy Updates via Microsoft Update Catalog

  • Scenario: The organization’s Endpoint Detection and Response (EDR) agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads the latest definition packs from update.microsoft.com or a specific CDN endpoint. URLhaus may flag these high-volume, frequently changing download URLs as “malware_download” due to their association with executable payloads, even though they are benign.
  • Filter/Exclusion: Create an exclusion rule targeting the hostnames *.update.microsoft.com, *.officecdn.microsoft.com, and the specific EDR vendor’s update domain (e.g., *.crowdstrike.com) when the user agent contains “Windows Update” or the specific EDR service name.

• Automated Patch Management via SCCM/Intune

  • Scenario: A scheduled System Center Configuration Manager (SCCM) or Microsoft Intune task runs nightly to distribute critical OS patches and application updates to workstations. These jobs initiate downloads from internal distribution points that mirror external content, often triggering the rule if the mirrored content originates from a URLhaus-monitored source tagged as malware_download.
  • Filter/Exclusion: Exclude traffic originating from the “System” account or specific service accounts (e.g., NT SERVICE\SCCM) associated with patch management processes. Additionally, filter out URLs containing path segments like /ccmexec, /intune, or /distribution within internal IP ranges.

• Software Deployment via Chocolatey or Ansible

  • Scenario: The IT operations team utilizes automation tools like Chocolatey or Ansible to deploy new software versions (e.g., Adobe Reader, Zoom) across the fleet. These tools