URLhaus: Vidar Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Vidar malware to exfiltrate critical assets like credentials and encryption keys by communicating through known malicious URLs identified by URLhaus. Proactively hunting for these specific network connections in Azure Sentinel is essential because Vidar’s stealthy data theft capabilities can compromise sensitive infrastructure before traditional signature-based detections trigger an alert.

IOC Summary

Threat: Vidar Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Vidar
let malicious_domains = dynamic(["62.60.226.185"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["62.60.226.185"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Vidar Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Scenario: Automated Backup Agents Scanning External Repositories

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently query external cloud storage endpoints (e.g., AWS S3 buckets, Azure Blob Storage) to verify integrity or initiate transfer jobs. These agents often connect to dynamic URLs that may be flagged by URLhaus as “suspicious” due to high traffic volume or shared IP ranges used by the cloud provider.
  • Filter/Exclusion: Create an exclusion rule for the specific service accounts running these backup agents (e.g., VeeamService, RubrikAgent) on the domain controller or endpoint detection layer, specifically targeting outbound connections to known public cloud CIDR blocks (e.g., *.amazonaws.com, *.azurewebsites.net).

• Scenario: Scheduled Patch Management and Software Updates

  • Context: Tools such as Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons execute scheduled jobs to download patches, software definitions, or license keys from vendor update servers. These downloads often occur during off-hours via HTTPS connections that may traverse through intermediate CDNs, triggering the Vidar rule if the URL structure resembles known exfiltration patterns.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts for these specific tools between 01:00 and 05:00 UTC (typical maintenance windows), or whitelist the specific vendor update domains (e.g., *.microsoft.com, *.ivanti.com) within the detection logic.

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: DevOps