URLhaus: botnetdomain Malicious URLs

Hunt Hypothesis

This detection identifies active communication with known botnet command-and-control domains by monitoring traffic against a curated list of five malicious URLs from URLhaus. Proactively hunting for this behavior in Azure Sentinel is critical to rapidly isolate compromised endpoints and disrupt botnet propagation before adversaries can establish persistent network footholds or exfiltrate sensitive data.

IOC Summary

Threat: botnetdomain Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: botnetdomain
let malicious_domains = dynamic(["dsgagfsahkfsahfjs.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["dsgagfsahkfsahfjs.shop"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: botnetdomain Malicious URLs rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe external threat intelligence feeds to validate their own signature databases. These tools often query known botnet domains as part of their baseline health checks, triggering the rule despite being legitimate administrative traffic.
  • Filter/Exclusion: Create an exclusion based on the Source Host or User Agent. Exclude traffic originating from specific scanner IP ranges (e.g., 10.20.50.x) or filter out requests where the User-Agent string contains keywords like “Tenable,” “Qualys,” or “Rapid7.”

• Scenario: Scheduled Endpoint Protection Updates

  • Context: Enterprise endpoint protection suites such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne perform scheduled daily updates. During these jobs, the agents connect to upstream threat intelligence servers that may be hosted on domains recently flagged by URLhaus due to shared infrastructure or temporary reputation issues.
  • Filter/Exclusion: Implement a time-based filter excluding detections occurring during known maintenance windows (e.g., 02:00 – 04:00 UTC). Alternatively, exclude specific process names associated with the update engine, such as C-Update.exe or SentinelOneAgent.exe.

• Scenario: Cloud Backup and Synchronization Services

  • Context: Corporate backup solutions like Veeam, Rubrik, or Microsoft OneDrive for Business often utilize dynamic DNS domains that are shared across multiple tenants. If a specific botnet domain is used by