URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries who embed malicious download URLs in phishing lures or compromised web assets to facilitate initial access and payload delivery. Proactively hunting for these specific URLhaus entries in Azure Sentinel allows the SOC to identify potential compromise vectors before they trigger full-blown malware execution or lateral movement.

IOC Summary

Threat: malware_download Total URLs: 7 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["124.94.203.196", "61.137.153.247", "42.6.60.211", "58.209.44.30", "42.55.51.96"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["124.94.203.196", "61.137.153.247", "42.6.60.211", "58.209.44.30", "42.55.51.96"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific version of a CI/CD tool (e.g., Jenkins agent, Ansible bootstrap script) from a URL that was temporarily hosted on a domain later flagged by URLhaus due to a transient compromise or misclassification.
  • Filter/Exclusion: Exclude source processes named curl, wget, or powershell when the destination URL path contains common artifact identifiers like /v1/, /release/, or /download/.
• Scenario: An automated scheduled task (e.g., a Windows Task Scheduler job or Linux cron job) runs a health check script that fetches a configuration file or certificate from an internal mirror or CDN edge node that shares a DNS record with a known malicious URLhaus entry.
  • Filter/Exclusion: Exclude alerts where the source process is schtasks.exe, taskeng.exe, or cron/crond, and the URL ends with standard file extensions like .json, .yaml, .pem, or .crt.
• Scenario: A legacy application or custom internal tool uses a hardcoded URL to fetch a license key or update manifest from a third-party vendor’s distribution server, which has been recently added to URLhaus due to a supply chain issue affecting multiple vendors.
  • Filter/Exclusion: Create a whitelist of known legitimate vendor domains (e.g., *.vendor-cdn.com, *.internal-mirror.corp) and exclude URLs matching these domains unless the user context is a non-standard service account.
• Scenario: A security team or blue team member manually tests a detection rule by downloading a benign file (e.g., a test script or sample image) from a URL that is currently listed in URLhaus as malware_download to verify alerting behavior.
  • **Filter/Ex