URLhaus: sh Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving newly identified malicious URLs tagged by URLhaus, which often indicate early-stage phishing or command-and-control communications. A proactive hunt is essential in Azure Sentinel to rapidly validate these emerging threats before they compromise endpoints or exfiltrate sensitive data within the organization’s network.

IOC Summary

Threat: sh Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: sh
let malicious_domains = dynamic(["160.119.71.134"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["160.119.71.134"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: sh Malicious URLs detection rule in an enterprise environment, along with recommended filters and exclusions:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise EDR solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently initiate background network calls to their update servers (e.g., update.crowdstrike.com, go.microsoft.com) to fetch the latest threat intelligence feeds. These URLs often contain dynamic query parameters that can trigger a generic “sh” (shell script) tag in URLhaus if the specific endpoint behavior is not fully whitelisted.
  • Filter/Exclusion: Create an exclusion based on the Process Name of the EDR agent (e.g., csagent.exe, MsMpEng.exe) and exclude traffic destined for known vendor update domains.

• Scheduled PowerShell Script Execution in DevOps Pipelines

  • Scenario: Internal CI/CD pipelines using Azure DevOps, Jenkins, or GitHub Actions often trigger scheduled jobs that download shell scripts (.sh files) from internal artifact repositories (e.g., Artifactory, Nexus) to perform deployment tasks. If these internal URLs are newly registered or lack a high reputation score in URLhaus, they may be flagged as malicious despite being legitimate build artifacts.
  • Filter/Exclusion: Exclude traffic originating from specific Service Accounts used by the CI/CD platform (e.g., svc-jenkins-build) and restrict the rule to only trigger on URLs containing external public domains rather than internal IP ranges or .internal zones.

• Third-Party Cloud Management Dashboard Refreshes

  • Scenario: Administrative users accessing cloud management consoles like AWS Console, Google Cloud Platform (GCP), or