URLhaus: rat Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where malicious actors distribute RAT (Remote Access Trojan) payloads through newly registered or compromised domains flagged by URLhaus to establish persistent remote access on victim endpoints. A SOC team should proactively hunt for these indicators in Azure Sentinel because RATs often serve as a critical foothold for lateral movement and data exfiltration, requiring immediate investigation before the adversary can fully entrench their presence within the network.

IOC Summary

Threat: rat Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["23.94.148.3", "pic.li"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["23.94.148.3", "pic.li"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: rat Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Threat Intelligence Feed Ingestion by Security Appliances

  • Context: Enterprise security gateways (e.g., Palo Alto Networks, Fortinet FortiGate) or EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently poll the URLhaus API (https://urlhaus-api.abuse.ch/v1/) to fetch the latest malicious URL feeds. The polling mechanism often triggers a connection to a known “rat” family URL within the feed data, causing the rule to flag the ingestion process itself as suspicious activity.
  • Filter/Exclusion: Exclude traffic originating from specific security appliance IP ranges or service accounts (e.g., Source_IP IN [10.20.1.5, 10.20.1.6] OR Process_Name = 'FalconSensor.exe') where the destination URL contains urlhaus-api.abuse.ch.

• Scenario: Scheduled Backup and Archive Jobs Accessing Cloud Repositories

  • Context: Automated backup solutions (e.g., Veeam Backup & Replication, Rubrik) running nightly scheduled jobs often access cloud storage endpoints that host “rat” family signatures or documentation. For instance, a job might download a signature update package from a vendor’s repository URL that matches the rule’s regex for RAT indicators, even though the content is benign and expected.
  • Filter/Exclusion: Create an exclusion based on scheduled task names (e.g., Scheduled_Task_Name LIKE '%VeeamBackupJob%') combined with time-of-day constraints (Event_Time BETWEEN '02:00' AND '06:00'), specifically targeting URLs