URLhaus: rat Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known malicious URLs associated with Remote Access Trojans (RATs) to identify potential footholds or command-and-control channels within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect and isolate compromised assets before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: rat Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["ficus.in"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["ficus.in"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) configured with a hardcoded health-check endpoint that pings a known URLhaus rat URL to verify network egress or cache warming. Filter: Exclude source IPs belonging to the App-Server-01 subnet or filter out traffic where the User-Agent header matches LegacyApp-HealthCheck/1.0.
• Scheduled Content Synchronization: A nightly scheduled job (e.g., SyncDocs.bat running via Task Scheduler on a file server) that uses curl or wget to fetch documentation or configuration files from a third-party CDN that has been temporarily flagged by URLhaus due to a shared IP reputation issue. Filter: Exclude processes named curl.exe or wget.exe initiated by the SYSTEM or svc-sync account, or filter out URLs ending in common static file extensions like .json or .xml if the rule is overly broad.
• Browser Extension Telemetry: A popular enterprise-approved browser extension (e.g., a productivity tool like Grammarly or a security scanner like Wappalyzer) that sends telemetry or update checks to a domain currently listed in the URLhaus rat feed due to a false positive in the domain’s reputation score. Filter: Exclude traffic originating from browser processes (chrome.exe, edge.exe) where the destination port is 443 and the User-Agent contains the specific extension identifier, or maintain an allowlist of known-good subdomains for approved extensions.
• CI/CD Pipeline Dependency Fetching: A Jenkins or GitHub Actions pipeline step that downloads a specific open-source library or binary from a GitHub release URL that has been transiently tagged as rat due to a compromised maintainer account or a temporary DNS hijack, which was subsequently resolved. Filter: Exclude source hosts labeled ci-runner-* or