URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing AgentTesla to establish command-and-control channels via known malicious URLs for sensitive data exfiltration. Proactively hunting these indicators in Azure Sentinel allows the SOC team to rapidly identify and contain active data theft campaigns before significant intellectual property or credentials are compromised.

IOC Summary

Threat: AgentTesla Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["misty-cherry-cea3.uploadsimg.workers.dev", "pub-45a83f302a1943ed8d62418c2af947ef.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["misty-cherry-cea3.uploadsimg.workers.dev", "pub-45a83f302a1943ed8d62418c2af947ef.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: AgentTesla Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Security Tool Self-Updates via Cloud Repositories

  • Context: Endpoint Protection platforms (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or backup agents (e.g., Veeam, Rubrik) frequently download update manifests and configuration files from cloud repositories that may host URLs similar to known AgentTesla distribution points. These legitimate downloads often contain the same hash signatures or URL patterns flagged by the rule.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from specific internal IP ranges of the Security Operations Center (SOC) or backup servers, and whitelist domains such as *.crowdstrike.com, *.microsoftonline.com, and *.veeam.com. Additionally, exclude traffic where the User-Agent string contains keywords like “CrowdStrikeUpdate”, “VeeamBackupService”, or “DefenderSvc”.

• Scenario: Scheduled Administrative Script Execution

  • Context: System administrators often run PowerShell scripts or Python automation tools (e.g., Ansible Tower, Jenkins) to fetch configuration templates, API keys, or software installers from internal artifact repositories (like Artifactory or Nexus). If these repositories host a file named agent_config.json or similar on a public-facing URL that matches the AgentTesla signature, legitimate script execution will trigger alerts.
  • Filter/Exclusion: Implement a filter based on the process name and command line. Exclude alerts where the initiating process is powershell.exe, python.exe, java.exe, or jenkins-agent executing from a known “Admin Workstation” OU (Organizational Unit). Specifically, exclude URLs containing paths like /artifacts/, /nexus/repository/, or /api/v1/config.