URLhaus: sh Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where compromised hosts initiate connections to newly identified malicious URLs flagged by URLhaus with an ‘sh’ (suspicious host) tag, indicating potential early-stage infection or command-and-control activity. The SOC team should proactively hunt for these indicators in Azure Sentinel because the high severity and specific tagging suggest a rapidly evolving threat landscape that requires immediate investigation before broader network propagation occurs.

IOC Summary

Threat: sh Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: sh
let malicious_domains = dynamic(["162.248.100.101", "72.56.52.158"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["162.248.100.101", "72.56.52.158"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: sh Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Software Update Mechanisms via Shell Scripts

  • Scenario: Automated patch management tools (e.g., Ansible, Puppet, or custom PowerShell/Bash scripts) frequently download update manifests or installer binaries from public repositories. If the script uses a shell wrapper (sh) to execute the curl or wget command, it may hit URLs hosted on domains that URLhaus has flagged due to recent reputation changes or shared hosting environments (e.g., GitHub Actions artifacts or Docker Hub layers).
  • Suggested Filter: Exclude traffic originating from known management servers (e.g., IP range of the Configuration Management Database) where the destination domain ends in .github.com, docker.io, or specific internal artifact repositories, provided the user agent string contains “Ansible” or “Puppet”.

• Scheduled Log Aggregation and Reporting Jobs

  • Scenario: Enterprise log management systems (e.g., Splunk, ELK Stack) often run scheduled cron jobs using shell scripts to fetch external threat intelligence feeds, weather data for capacity planning, or currency exchange rates. These jobs may query APIs hosted on domains that URLhaus has temporarily tagged as sh due to high-volume scanning noise or recent certificate rotations, even though the content is benign.
  • Suggested Filter: Create an exclusion rule for scheduled tasks running during off-peak maintenance windows (e.g., 02:00–04:00 UTC) where the source process name matches cron, systemd-timer, or specific service accounts like svc-log-collector.

• Third-Party Integration Webhooks and API Polling

  • Scenario: DevOps pipelines (e.g., **