URLhaus: android Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of Android-specific malicious payloads delivered via known bad URLs, indicating a potential compromise of mobile endpoints or lateral movement from mobile devices into the corporate network. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify early-stage mobile threats that traditional server-centric monitoring may miss, ensuring comprehensive coverage across all user access points.

IOC Summary

Threat: android Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat:  android
let malicious_domains = dynamic(["176.65.139.250"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.250"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Mobile Device Management (MDM) Profile Synchronization: Enterprise MDM solutions like Intune or AirWatch often push configuration profiles or app deployment scripts to Android devices via HTTPS endpoints. If the MDM server’s certificate or URL is temporarily registered in URLhaus due to a shared infrastructure or false positive tagging, legitimate sync operations will trigger the alert.
  • Filter/Exclusion: Exclude URLs ending in /sync, /push, or /config from known MDM vendor domains (e.g., *.intunemanagement.com, *.airwatch.com).
• Corporate Wi-Fi Captive Portal Authentication: When employees connect Android devices to the corporate guest or employee Wi-Fi, they are redirected to a captive portal for authentication (e.g., IdeaController or ClearPass). These portals often use dynamic URLs or subdomains that may be flagged if the underlying infrastructure is shared with other services.
  • Filter/Exclusion: Exclude URLs containing /portal, /login, or /auth from known network controller domains (e.g., *.clearpass.hpe.com, *.ideacontroller.com).
• Android App Store API Calls for Enterprise Apps: Internal or public app distribution platforms (e.g., SAP Build or Custom In-House App Stores) serve app binaries or metadata via HTTPS. If the API endpoint is used for both app downloads and other services, it might be tagged in URLhaus if a specific version had a vulnerability.
  • Filter/Exclusion: Exclude URLs matching /api/v1/apps, /download, or /metadata from internal app store domains (e.g., *.sap.com, *.internal-appstore.corp.net).
• Push Notification Service (FCM) Connectivity: Android devices frequently connect to Firebase Cloud Messaging (FCM) endpoints for push notifications. While FCM