URLhaus: Amos Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of the Amos banking trojan, which typically initiates via malicious URLs delivered through phishing or compromised web pages to establish a foothold in the environment. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the trojan from deploying its keylogger and stealing sensitive financial or corporate credentials.

IOC Summary

Threat: Amos Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Amos
let malicious_domains = dynamic(["genovaw.com", "implantdentistrytx.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["genovaw.com", "implantdentistrytx.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A security operations team or CI/CD pipeline uses curl or wget to verify the availability or integrity of known malicious endpoints (e.g., http://185.154.197.108/amos) during a threat hunt or post-incident validation.

  • Filter/Exclusion: Exclude processes where the parent process is curl.exe, wget.exe, or powershell.exe if the command line contains specific verification flags (e.g., -I, --head) or if the source IP belongs to the SOC jump server subnet.

• Scenario: An automated backup or log ingestion job (e.g., using rsync or a custom Python script) pulls remote configuration files or threat intelligence feeds from a staging server that mirrors URLhaus data, inadvertently accessing the Amos-tagged URLs as part of a bulk download.

  • Filter/Exclusion: Exclude events where the user account is a service account (e.g., svc-backup, svc-log-ingest) and the destination path contains keywords like /backups/, /logs/, or /threat-intel/.

• Scenario: A developer or QA engineer runs a local web server (e.g., nginx, apache, or python -m http.server) to test client-side JavaScript or API integrations, and the test environment includes a mock endpoint that resolves to one of the Amos IPs for load testing or proxy configuration validation.

  • Filter/Exclusion: Exclude connections where the local port is a standard web server port (80, 443, 8080) and the process name is a known web server binary (nginx.exe, httpd.exe, python.exe with http.server in the command line).

• Scenario: A network monitoring tool (e