URLhaus: botnet Malicious URLs

Hunt Hypothesis

Adversaries may use malicious URLs from URLhaus to deploy botnet payloads, establishing command and control channels. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate botnet command and control infrastructure before it causes widespread compromise.

IOC Summary

Threat: botnet Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: botnet
let malicious_domains = dynamic(["182.126.121.80", "103.42.243.35"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.121.80", "103.42.243.35"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Scheduled system update job downloads a known botnet URL from a trusted repository
  Filter/Exclusion: Exclude URLs matching https://updates.examplecorp.com/* or use a custom list of internal update servers

• Scenario: Admin manually tests a botnet URL in a sandbox environment for analysis
  Filter/Exclusion: Exclude URLs containing sandbox.examplecorp.com or use a regex to identify sandbox testing URLs

• Scenario: A legitimate security tool (e.g., CrowdStrike Falcon) uses a botnet URL for signature validation
  Filter/Exclusion: Exclude URLs that match https://falcon.examplecorp.com/signature-validation/*

• Scenario: A CI/CD pipeline pulls a dependency from a public registry that is flagged as a botnet URL
  Filter/Exclusion: Exclude URLs containing npm.pkg.github.com or registry.npmjs.org and use a whitelisted package list

• Scenario: A user accesses a phishing page that mimics a legitimate internal URL (e.g., https://internal-portal.example.com)
  Filter/Exclusion: Exclude URLs that match internal domain patterns using a regex like ^https?:\/\/internal-\w+\.example\.com\/