URLhaus: rat Malicious URLs

Hunt Hypothesis

This rule detects the presence of URLs associated with the RAT malware family, indicating that an adversary is likely using these specific endpoints for command-and-control or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised assets or active threat actor infrastructure before the malware can fully establish persistence or exfiltrate sensitive data.

IOC Summary

Threat: rat Total URLs: 5 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["web.opendrive.com", "od.lk"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["web.opendrive.com", "od.lk"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to dynamically generate temporary S3 bucket URLs or Azure Blob Storage links for artifact storage, where the URL structure coincidentally matches a known RAT payload pattern (e.g., http://192.168.x.x:8080/upload.php?file=...).
  • Filter/Exclusion: Exclude URLs where the host is an internal IP range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) AND the user agent string contains “Jenkins”, “GitHub-Actions”, or “Azure-CLI”.
• Scenario: An IT administrator runs a scheduled PowerShell script to fetch configuration files from an internal web server for mass deployment, where the URL includes query parameters that resemble a URLhaus RAT entry (e.g., https://internal-cfg.corp.com/config?ver=2.1&token=abc123).
  • Filter/Exclusion: Exclude URLs where the domain ends with .corp.com or .internal AND the process name is powershell.exe or pwsh.exe initiated by a service account (e.g., DOMAIN\svc-deploy).
• Scenario: A security team performs a vulnerability scan using a tool like Nessus or Qualys, which probes endpoints with specific URL patterns to test for information disclosure or known vulnerabilities, triggering the rule due to the URL structure matching a RAT signature.
  • Filter/Exclusion: Exclude URLs where the source IP belongs to the security scanning subnet (e.g., 10.20.30.0/24) AND the user agent contains “Nessus”, “Qualys”, or “OpenVAS