URLhaus: msstore Malicious URLs

Hunt Hypothesis

This rule detects adversaries leveraging malicious Microsoft Store URLs to execute payloads or establish footholds, a tactic that often bypasses traditional perimeter defenses by exploiting trusted application distribution channels. Proactively hunting for these specific URLhaus entries in Azure Sentinel allows the SOC to identify compromised endpoints or users interacting with these high-severity threats before they progress to lateral movement or data exfiltration.

IOC Summary

Threat: msstore Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: msstore
let malicious_domains = dynamic(["raw.githubusercontent.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["raw.githubusercontent.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Microsoft Store App Deployment via Intune/SCCM: Administrators deploying the Microsoft Store app or specific Store-based applications (e.g., Teams, Office) to endpoints often use scripts that reference msstore:// or related Microsoft Store URLs for activation or configuration.
  • Filter/Exclusion: Exclude events where the source process is a known management agent such as IntuneAgent.exe, CCMAgent.exe, or MsiExec.exe and the user account belongs to a service or admin group (e.g., DOMAIN\svc-intune or DOMAIN\admins).
• Developer/IT Pro Testing of MSIX Packages: IT professionals or developers packaging and testing MSIX/MSIX bundles locally may invoke the Microsoft Store protocol to register or validate app packages, generating traffic to Microsoft Store endpoints.
  • Filter/Exclusion: Exclude events originating from processes associated with development tools like dotnet.exe, msbuild.exe, or VisualStudioCode.exe on machines tagged as “Dev” or “Test” in your CMDB.
• Scheduled Maintenance Jobs for App Updates: Enterprise scheduled tasks (e.g., via Task Scheduler or Group Policy) that force Microsoft Store app updates or clean up cache may trigger URL requests to Microsoft Store services.
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe with the service name WaaSMedicSvc (Windows Update Medication Service) or Store service, or where the command line contains arguments like /update or /clean.
• User-Initiated App Installation from Web Portal: Users accessing the Microsoft Store web portal (store.microsoft.com) and clicking “Install” may trigger local protocol handlers that resolve to msstore URLs, especially if the Store app is not fully installed or is in a transitional state.
  • *Filter