URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This rule detects adversary activity where a downloader malware fetches secondary payloads from known malicious URLs, indicating an active attempt to expand foothold or escalate privileges within the environment. Proactively hunting for these specific URLhaus indicators in Azure Sentinel allows the SOC to identify compromised endpoints early, potentially intercepting the execution of subsequent stages before they establish persistence or lateral movement.

IOC Summary

Threat: malware_download Total URLs: 4 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["60.23.235.89"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["60.23.235.89"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to fetch a specific build artifact or dependency from a temporary staging server or a known third-party CDN that is listed in URLhaus due to a recent compromise or shared IP reputation.
  • Filter/Exclusion: Exclude network connections where the source process is a known build agent (e.g., java.exe, node.exe, python.exe in CI contexts) and the destination domain matches a verified allowlist of staging or CDN domains (e.g., *.s3.amazonaws.com, *.githubusercontent.com).
• Scenario: An IT administrator runs a scheduled PowerShell script to download and execute a patch or utility from an internal file server or a public repository (e.g., https://raw.githubusercontent.com/...) that has a transient bad reputation score in URLhaus due to a new malware family using the same domain structure.
  • Filter/Exclusion: Exclude events where the source process is powershell.exe or pwsh.exe and the command line contains explicit download verbs (Invoke-WebRequest, curl, wget) targeting internal IP ranges or known public repository domains, provided the script execution is initiated by a scheduled task or service account.
• Scenario: A security team performs a live validation test by visiting a known malicious URL from URLhaus in a sandboxed browser or using a tool like curl to verify the detection rule’s efficacy, triggering the alert on the analyst’s workstation.
  • Filter/Exclusion: Exclude events originating from user accounts tagged with a SOC or Security group, or where the source process is a browser (chrome.exe, edge.exe) or CLI tool (curl.exe, wget.exe) and the destination URL matches the specific test URL or domain currently under investigation.
• Scenario: A legacy