URLhaus: apk Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects potential exfiltration of sensitive data and execution of arbitrary code via malicious APKs distributed through compromised URLs. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced Android malware threats before they cause significant data loss or system compromise.

IOC Summary

Threat: apk Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: apk 
let malicious_domains = dynamic(["maxvideo2026.vercel.app", "vidrudtp.vercel.app"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["maxvideo2026.vercel.app", "vidrudtp.vercel.app"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate Android App Update Distribution
  Description: A company uses a third-party app store or internal repository to distribute app updates, which may include .apk files that are signed and verified.
  Filter/Exclusion: process.name != "adb" && process.name != "apksigner" && process.name != "jarsigner" && process.name != "signapk"

• Scenario: Scheduled System Maintenance Job
  Description: A system administrator schedules a job to update or patch Android-based devices using a legitimate tool like Android Debug Bridge (ADB) or Fastboot.
  Filter/Exclusion: process.name != "adb" && process.name != "fastboot" && process.name != "aapt" && process.name != "pm"

• Scenario: Internal Tool for APK Signing and Packaging
  Description: The security team uses internal tools like apksigner or jarsigner to sign and package internal Android applications for distribution.
  Filter/Exclusion: process.name != "apksigner" && process.name != "jarsigner" && process.name != "signapk" && process.name != "zipalign"

• Scenario: User-Initiated File Transfer via USB
  Description: An employee transfers an .apk file from a personal device to a work device via USB, which may be flagged as suspicious.
  Filter/Exclusion: process.name != "adb" && process.name != "fastboot" && process.name != "mount" && process.name != "dd"

• Scenario: Automated CI/CD Pipeline for Android Apps
  Description: A CI/CD pipeline builds and packages Android apps using tools like Gradle or Android Studio, which may generate .apk files that are flagged.
  Filter/Exclusion: `process.name != ”