URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging known malicious URLs to distribute malware downloads, which often serve as an initial entry point or lateral movement vector within the network. Proactively hunting for these specific indicators in Azure Sentinel is critical because early identification of compromised download sources allows the SOC team to isolate affected endpoints and block malicious traffic before widespread infection occurs.

IOC Summary

Threat: malware_download Total URLs: 10 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["42.230.54.173", "123.188.223.103", "27.37.226.228", "27.37.229.199"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.230.54.173", "123.188.223.103", "27.37.226.228", "27.37.229.199"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download Malicious URLs detection rule, along with targeted exclusion strategies:

• Scenario: Automated Antivirus Definition Updates

  • Context: Enterprise Endpoint Protection agents (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) automatically pull definition updates from vendor cloud repositories. These update servers often host dynamic URLs that may be flagged by URLhaus due to high traffic volume or recent content changes, triggering the malware_download tag even though the payload is a trusted signature file.
  • Filter/Exclusion: Create an exclusion rule based on the known FQDNs of security vendors (e.g., *.update.microsoft.com, *.crowdstrike.com) and restrict the detection to exclude traffic originating from specific “Update Service” accounts or scheduled tasks running during maintenance windows.

• Scenario: Software Deployment via Configuration Management Tools

  • Context: During routine patching cycles, tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible download installer packages (.msi, .exe) from internal artifact repositories or public CDNs (e.g., Azure Blob Storage, AWS S3). If these repositories host third-party software installers that have recently been scanned by URLhaus, the download event may be misclassified as a malicious malware download.
  • Filter/Exclusion: Exclude traffic where the source process is ccmexec.exe (SCCM) or ansible-playbook, and filter out URLs containing known internal artifact paths (e.g., /packages/, /deployments/) that are whitelisted in the organization’s asset inventory.

• Scenario: Browser-Based Admin Portal Access

  • Context: System administrators frequently access third-party SaaS management consoles (e.g., Okta, Jira, ServiceNow) to download reports or configuration templates. These portals often