URLhaus: AgentTesla Malicious URLs

Hunt Hypothesis

This hypothesis targets the presence of AgentTesla malware, a data exfiltration tool that typically enters the environment via phishing links or compromised web redirects to steal credentials and sensitive system information. Proactively hunting for these malicious URLs in Azure Sentinel allows the SOC team to identify compromised endpoints early by correlating user activity with known C2 domains, thereby preventing lateral movement and credential theft before significant data is exfiltrated.

IOC Summary

Threat: AgentTesla Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: AgentTesla
let malicious_domains = dynamic(["pub-f9f2f77b53d14531ba49bd6d0bd18740.r2.dev", "activegrp.co.za"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-f9f2f77b53d14531ba49bd6d0bd18740.r2.dev", "activegrp.co.za"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legitimate Phishing Simulation Campaigns

  • Scenario: Security teams (e.g., using KnowBe4 or GoPhish) often deploy realistic phishing simulations that include URLs hosted on domains registered to mimic known malware families or C2 infrastructure to test user awareness. These URLs may be registered on dynamic DNS services or obscure registrars, triggering URLhaus alerts if the domain is recently added to threat intelligence feeds.
  • Filter/Exclusion: Exclude URLs where the User-Agent string contains simulation tool identifiers (e.g., GoPhish, KnowBe4) or restrict the rule to non-IT/Security department accounts. Alternatively, whitelist specific IP ranges or domain suffixes (e.g., *.phishing-sim.com) used exclusively for internal testing.

• Cloud Storage and File Sharing Services

  • Scenario: Enterprise users frequently share large files or documents via cloud services like OneDrive, SharePoint, or Box. These services use dynamic subdomains or long, complex URL structures for file access. If a user shares a file with a name or path that coincidentally matches a known AgentTesla C2 domain pattern (e.g., a generic term like update or sync), or if the cloud service’s CDN IP range overlaps with a newly identified C2 IP, the rule may fire.
  • Filter/Exclusion: Exclude URLs containing standard cloud service path patterns (e.g., /s/, /files/, /share/) or specific known cloud domains (onedrive.live.com, sharepoint.com, box.com). Ensure the rule does not trigger on HTTP 200 responses with Content-Type: text/html from known cloud CDNs.

• Scheduled Software Update Checks

  • Scenario: Many enterprise applications (e.g., Adobe Creative Cloud, Java, .NET Framework, or custom internal tools) perform