URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints initiate downloads from known malicious sources identified by URLhaus to deploy malware payloads within the network. Proactively hunting for these specific indicators in Azure Sentinel is critical because it enables the SOC team to identify and isolate compromised assets before the downloaded malware executes its full attack chain.

IOC Summary

Threat: malware_download Total URLs: 11 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["misty-cherry-cea3.uploadsimg.workers.dev", "gurdjieff-philadelphia.org", "redhiban.cfd", "27.124.34.73"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["misty-cherry-cea3.uploadsimg.workers.dev", "gurdjieff-philadelphia.org", "redhiban.cfd", "27.124.34.73"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, including suggested filters and exclusions:

• Enterprise Software Update Agents

  • Scenario: Automated patch management tools like Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or Jamf Pro frequently download executable installers (.msi, .exe) from vendor repositories. These URLs often host large binaries that URLhaus may flag as “malware_download” due to the file type and high traffic volume, even though the source is trusted.
  • Suggested Filter: Create an exclusion for outbound traffic originating from specific Service Accounts (e.g., svc-sccm-updater) or restrict the rule to exclude known vendor domains (e.g., *.microsoft.com, *.jamfsoftware.com, *.oracle.com).

• Scheduled Backup and Archiving Jobs

  • Scenario: Scheduled tasks running via Windows Task Scheduler or Ansible that connect to cloud storage providers like AWS S3, Azure Blob Storage, or Box Enterprise to retrieve backup manifests or compressed archives (.zip, .tar). These downloads often contain nested executable structures that trigger the malware signature, despite being part of a routine data integrity check.
  • Suggested Filter: Exclude traffic generated by specific scheduled job names (e.g., Daily_Backup_Integrity_Check) and filter out URLs containing standard backup path patterns (e.g., /backup/, /archive/, or query parameters like ?action=download).

• IT Administration and Helpdesk Tooling

  • Scenario: IT administrators using remote management suites like SolarWinds, ServiceNow, or Splunk to download diagnostic logs, agent installers, or configuration scripts. When an admin manually triggers a “Download