URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt targets the execution of known malicious download URLs, a common initial access vector where adversaries fetch payloads to establish a foothold in the environment. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to detect and isolate compromised assets before the malware can propagate or execute further post-exploitation actions.

IOC Summary

Threat: malware_download Total URLs: 16 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["31.173.199.131", "175.173.116.250", "42.53.173.75", "220.201.147.91", "123.188.85.62", "150.158.132.39", "108.170.136.155"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.173.199.131", "175.173.116.250", "42.53.173.75", "220.201.147.91", "123.188.85.62", "150.158.132.39", "108.170.136.155"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific build artifact or dependency from a staging CDN that shares a subdomain or IP with a known URLhaus entry due to a shared hosting provider or misconfigured DNS.
  • Filter/Exclusion: Exclude network connections where the source process is curl.exe, wget.exe, or powershell.exe AND the destination port is 443 (HTTPS), provided the source user belongs to the DevOps or Engineering group.
• Scenario: An automated backup or sync job (e.g., Veeam, Commvault, or a custom Python script) connects to a remote repository or object storage endpoint that has been recently flagged by URLhaus due to a compromised instance, but the connection is part of a scheduled, low-privilege service account task.
  • Filter/Exclusion: Exclude alerts where the source process is a known backup agent (e.g., vbragent.exe, commvault_agent.exe) or a scheduled task named *Backup* or *Sync*, and the destination URL matches the specific URLhaus entry but the source user is a service account (e.g., svc_backup).
• Scenario: A security team or incident response analyst manually downloads a sample file or IOC list from a URLhaus-hosted URL for analysis in a sandbox or isolated lab environment, triggering the detection on the analyst’s workstation or jump host.
  • Filter/Exclusion: Exclude alerts where the source machine is tagged as Lab, Sandbox, or JumpHost in CMDB, or where the source user belongs to the SecurityTeam or IR group, and the process is chrome.exe, firefox.exe, or curl.exe.
• Scenario: A CI/CD pipeline (e.g., Jenkins, GitHub