← Back to SOC feed Coverage →

URLhaus: malware_download Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-22T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversaries leveraging known malicious URLs from the URLhaus threat intelligence feed to distribute malware families via web-based downloads. Proactive hunting for these indicators in Azure Sentinel is critical to intercept initial infection vectors before they compromise endpoints and propagate laterally across the network.

IOC Summary

Threat: malware_download Total URLs: 23 Active URLs: 19

URLStatusThreatDate Added
hxxps://winds11.site/aa/Setup.raronlinemalware_download2026-08-22
hxxp://47.129.178.214:8092/app_JnCFbH.webponlinemalware_download2026-08-22
hxxp://223.105.50.190:35667/iofflinemalware_download2026-08-22
hxxp://223.105.50.190:35667/bin.shofflinemalware_download2026-08-22
hxxp://124.94.144.192:55986/ionlinemalware_download2026-08-22
hxxp://42.5.8.190:54830/ionlinemalware_download2026-08-22
hxxp://125.59.14.119:49412/iofflinemalware_download2026-08-22
hxxp://119.115.33.201:51030/ionlinemalware_download2026-08-22
hxxp://42.54.18.142:43500/ionlinemalware_download2026-08-22
hxxp://58.255.43.126:35671/ionlinemalware_download2026-08-22
hxxp://163.142.92.235:39139/ionlinemalware_download2026-08-22
hxxp://175.151.83.137:53442/bin.shonlinemalware_download2026-08-22
hxxp://175.151.83.137:53442/ionlinemalware_download2026-08-22
hxxp://42.7.217.91:35797/ionlinemalware_download2026-08-22
hxxp://223.108.82.26:33999/bin.shonlinemalware_download2026-08-22
hxxp://223.108.82.26:33999/ionlinemalware_download2026-08-22
hxxp://175.107.210.253:44599/ionlinemalware_download2026-08-22
hxxp://42.5.254.164:39916/ionlinemalware_download2026-08-22
hxxp://113.239.64.220:36469/bin.shonlinemalware_download2026-08-22
hxxp://42.177.182.116:42583/bin.shonlinemalware_download2026-08-22
hxxp://113.239.116.131:52454/bin.shofflinemalware_download2026-08-22
hxxp://194.59.30.63:56439/b/amd64onlinemalware_download2026-08-22
hxxp://194.59.30.63:56439/b/linuxonlinemalware_download2026-08-22

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["42.5.8.190", "223.108.82.26", "113.239.64.220", "175.151.83.137", "194.59.30.63", "58.255.43.126", "42.177.182.116", "47.129.178.214", "42.5.254.164", "winds11.site", "124.94.144.192", "163.142.92.235", "42.54.18.142", "175.107.210.253", "119.115.33.201", "42.7.217.91"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.5.8.190", "223.108.82.26", "113.239.64.220", "175.151.83.137", "194.59.30.63", "58.255.43.126", "42.177.182.116", "47.129.178.214", "42.5.254.164", "winds11.site", "124.94.144.192", "163.142.92.235", "42.54.18.142", "175.107.210.253", "119.115.33.201", "42.7.217.91"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: malware_download Malicious URLs detection rule, including specific enterprise contexts and recommended filters:

Original source: https://urlhaus.abuse.ch/