URLhaus: rat Malicious URLs

Hunt Hypothesis

This hypothesis targets the use of Remote Access Trojan (RAT) infrastructure, where adversaries leverage known malicious URLs to establish persistent command-and-control channels or execute payloads. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints or web sessions before the RAT fully establishes persistence or exfiltrates sensitive data.

IOC Summary

Threat: rat Total URLs: 7 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: rat
let malicious_domains = dynamic(["141.98.10.177", "res.cloudinary.com", "pub-0216fa08b2b94e129cb9e002cf7cb1f4.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["141.98.10.177", "res.cloudinary.com", "pub-0216fa08b2b94e129cb9e002cf7cb1f4.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a custom Java-based inventory system) uses a hardcoded health-check endpoint that pings a specific URLhaus-listed RAT URL to verify outbound connectivity or retrieve a configuration token. This is common in older systems where the developer used a known public URL as a “canary” for network reachability.

  • Filter/Exclusion: Exclude alerts where the source process is a known legacy application binary (e.g., java.exe or app_server.exe) and the destination URL matches the specific RAT URL, provided the source IP is within the internal application server subnet.

• Scheduled Backup Verification Jobs: An IT operations team has a scheduled PowerShell or Python script that runs daily to validate that backup storage endpoints are reachable. The script includes a list of test URLs, one of which coincidentally matches a URLhaus RAT entry (possibly due to a shared domain structure or a reused test endpoint). The job runs from a dedicated service account on a jump host.

  • Filter/Exclusion: Exclude alerts where the initiating process is powershell.exe or python.exe and the parent process is a scheduled task service (e.g., taskschd.msi or svchost.exe with a specific task name), and the user account is a known service account (e.g., svc-backup-verify).

• Developer Localhost Testing: A developer on a workstation is running a local instance of a web application that uses a mock API gateway. The mock configuration file points to a specific URLhaus RAT URL as a placeholder for an external dependency during local testing. The developer’s browser or local HTTP client initiates the request, which gets captured by the network sensor.

  • Filter/Exclusion: Exclude alerts where the source IP is within the developer workstation VLAN range and the destination URL is accessed