URLhaus: script Malicious URLs

Hunt Hypothesis

This detection identifies adversaries leveraging malicious scripts hosted on compromised or newly registered domains to execute initial access and command-and-control activities via browser-based interactions. Proactive hunting for these URLhaus script indicators in Azure Sentinel is critical to intercept early-stage web-delivered attacks before they establish persistence or exfiltrate sensitive data through the organization’s network perimeter.

IOC Summary

Threat: script Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: script
let malicious_domains = dynamic(["77.239.124.108", "103.77.246.150"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["77.239.124.108", "103.77.246.150"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: script Malicious URLs detection rule, including context and recommended filtering strategies:

• Automated Cloud Backup & Sync Agents

  • Scenario: Enterprise backup solutions like Veeam, Rubrik, or Microsoft OneDrive/SharePoint sync clients frequently query dynamic endpoints to verify file integrity or download incremental updates. These agents often generate unique, parameter-heavy URLs containing script-like tokens (e.g., ?token=...&sessionid=...) that URLhaus may flag as suspicious due to their length and structure.
  • Filter/Exclusion: Create a whitelist rule excluding traffic from the specific service account user IDs or IP ranges associated with these backup agents. Alternatively, exclude URLs containing known vendor-specific path prefixes (e.g., *.veeam.com, *.onedrive.live.com) where the query string contains standard synchronization parameters.

• SIEM and EDR Telemetry Heartbeats

  • Scenario: Security platforms such as Splunk, CrowdStrike Falcon, or SentinelOne regularly send telemetry data to their cloud management consoles. These heartbeats often involve GET requests to endpoints that include script execution parameters for version checking or configuration polling, which can mimic the signature of a malicious script delivery URL.
  • Filter/Exclusion: Implement an exclusion based on the destination domain (e.g., *.splunk.com, *.crowdstrike.com) and restrict the alert to only trigger when the HTTP method is not GET or when the user agent string does not match the known EDR/SIEM client signature.

• Scheduled Patch Management Jobs

  • Scenario: Automated patch management tools like WSUS (Windows Server Update Services), SCCM (Microsoft Endpoint Configuration Manager), or Jamf execute scheduled jobs to fetch