URLhaus: malware_download Malicious URLs

Hunt Hypothesis

The hypothesis is that adversaries are using known malicious URLs from URLhaus to download malware into the network, leveraging compromised or phishing-based delivery methods. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential malware infections before they spread laterally or exfiltrate data.

IOC Summary

Threat: malware_download Total URLs: 11 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["107.172.235.213"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["107.172.235.213"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Scheduled System Update Check
  Description: A system administrator runs a scheduled task to check for and download the latest security updates from a trusted Microsoft server.
  Filter/Exclusion: Exclude URLs matching https://download.microsoft.com or use a filter for URLs containing update and microsoft.com.

• Scenario: Internal Software Repository Access
  Description: Developers access an internal artifact repository (e.g., Nexus or Artifactory) to download build tools or dependencies.
  Filter/Exclusion: Exclude URLs containing internal-repo.company.com or use a filter for URLs with artifactory or nexus in the domain.

• Scenario: Admin Task for Log Collection
  Description: An admin uses a tool like Logstash or Fluentd to collect logs from remote servers and downloads configuration files from a central server.
  Filter/Exclusion: Exclude URLs containing logstash or fluentd in the path, or use a filter for URLs with config or logs in the query parameters.

• Scenario: Cloud Backup Job Execution
  Description: A cloud backup tool like Veeam or Commvault connects to a remote storage bucket to download backup archives.
  Filter/Exclusion: Exclude URLs containing veeam.com or commvault.com, or use a filter for URLs with backup or restore in the path.

• Scenario: Patch Management Tool Usage
  Description: A patch management tool like Microsoft Endpoint Manager or Altiris downloads patches from a central patch server.
  Filter/Exclusion: Exclude URLs containing endpointmanager.microsoft.com or altiris.net, or use a filter for URLs with patch or update in the path.