URLhaus: xworm Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity involving communication with known XWorm malware distribution URLs to identify potential initial infection vectors or command-and-control traffic within the network. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the worm propagates across the organization’s infrastructure.

IOC Summary

Threat: xworm Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: xworm
let malicious_domains = dynamic(["pub-45a83f302a1943ed8d62418c2af947ef.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-45a83f302a1943ed8d62418c2af947ef.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: xworm Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to verify SSL certificates or check for known malicious signatures. These tools often query URLhaus feeds directly, triggering the xworm tag even though the traffic is a scheduled health check rather than user-initiated browsing.
  • Suggested Filter/Exclusion: Exclude network traffic originating from specific scanner IP ranges (e.g., 10.20.50.x) or filter out alerts where the source process name matches known scanner executables like nessuscli.exe or qualyspcapd.exe.

• Scenario: Endpoint Protection Cloud Updates

  • Context: Enterprise EDR solutions (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) perform periodic cloud intelligence updates. These agents connect to the vendor’s update servers, which may host URLs tagged with xworm in the URLhaus database as part of a broader threat feed integration, causing the detection logic to trigger on legitimate telemetry traffic.
  • Suggested Filter/Exclusion: Create an exclusion rule for outbound connections where the destination domain matches the vendor’s update infrastructure (e.g., *.crowdstrike.com, *.sentinelone.net) and the source process is the specific EDR agent service (e.g., csfalcon.exe or SentinelOneAgent.exe).

• Scenario: Scheduled Data Backup and Synchronization Jobs

  • Context: Automated backup solutions like Veeam, Rubrik, or cloud sync tools (**