URLhaus: script Malicious URLs

Hunt Hypothesis

This rule detects adversaries deploying malicious scripts via phishing or compromised web assets to establish backdoors and exfiltrate sensitive data. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage compromise and prevent lateral movement or credential theft before the threat actor achieves their objectives.

IOC Summary

Threat: script Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: script
let malicious_domains = dynamic(["129.159.135.190"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.159.135.190"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice, where the build process dynamically generates a temporary URL for health checks or artifact storage that matches the pattern of known malicious script hosts.

  • Filter/Exclusion: Exclude URLs originating from internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12) or specific trusted subdomains like *.internal.corp.com and *.ci-cd.example.com when the user agent is identified as a known automation tool (e.g., Jenkins/2.426, GitHub-Actions/1.0).

• Scenario: An IT administrator runs a scheduled PowerShell script to update client endpoints using a third-party management agent (e.g., SCCM, Intune, or Ansible) that fetches configuration files or update manifests from a public CDN or S3 bucket, which may be hosted on a domain previously flagged by URLhaus due to a shared infrastructure provider.

  • Filter/Exclusion: Exclude URLs accessed by service accounts or specific process names (e.g., powershell.exe invoked by ccmexec.exe or ansible-playbook) if the destination port is 443 and the TLS certificate is valid and issued by a trusted CA (e.g., Let’s Encrypt, DigiCert) rather than a self-signed or obscure CA.

• Scenario: A web development team hosts a staging environment for a new e-commerce feature on a temporary domain (e.g., staging-abc123.netlify.app or preview-xyz.vercel.app) that is used for QA testing. These domains are often short-lived and may share DNS records or hosting providers with known malicious script hosts, triggering false positives in URL