URLhaus: rat Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving remote access trojan (RAT) infections by monitoring traffic to known malicious URLs flagged by URLhaus. SOC teams should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement or data exfiltration before the RAT establishes persistent command-and-control channels.

IOC Summary

Threat: rat Total URLs: 3 Active URLs: 1

URL	Status	Threat	Date Added
`hxxps://web.opendrive.com/api/v1/download/file.json/MjlfNjU3MDI5NTdfNlNTNEQ?temp_key=%8Ah4%F7%7D%F4%DE%99%E0&inline=0`	offline	malware_download	2026-08-31
`hxxps://lively-fog-af49.pablosoftwareplus.workers.dev/ZwdOQ`	offline	malware_download	2026-08-31
`hxxps://alphapicaficagency.com/stego_88zloq9er8.png`	online	malware_download	2026-08-31

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["alphapicaficagency.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["alphapicaficagency.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: rat Malicious URLs detection rule in an enterprise environment:

Scenario: Automated Software Update Scanners
- Context: Enterprise endpoint management tools like Microsoft Defender for Endpoint, Jamf Pro, or Ivanti Neurons frequently query URLhaus APIs to fetch the latest threat intelligence feeds. These queries often return URLs tagged with rat (Remote Access Trojan) as part of a general “malicious” category scan, even when the specific URL is being used for legitimate update verification rather than active infection.
- Suggested Filter: Exclude traffic originating from known internal management server IP ranges (e.g., 10.20.x.x) or filter out requests where the User-Agent string contains keywords like Microsoft-Defender, JamfAgent, or Ivanti.
Scenario: Scheduled Security Compliance Audits
- Context: Automated compliance tools such as Qualys, Tenable Nessus, or CrowdStrike Falcon run scheduled jobs (e.g., nightly at 02:00 UTC) that probe external threat intelligence sources. During these scans, the tools may retrieve a list of known rat URLs to validate their local database signatures, triggering the rule without any actual user interaction or active malware presence on endpoints.
- Suggested Filter: Create an exclusion based on time windows (e.g., exclude alerts generated between 01:00 and 04:00 UTC) for source IPs belonging to security management appliances, or filter out events where the Event_Type is explicitly marked as “Passive Scan” rather than “Active Threat”.
Scenario: Cloud-Based DLP and Email Gateway Probing
- Context: Data Loss Prevention (DLP) solutions like **Symantec