URLhaus: botnetdomain Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where compromised hosts within the Azure Sentinel environment attempt to communicate with known botnet command-and-control domains identified by URLhaus. Proactively hunting for these specific malicious URLs is critical to identify early-stage botnet infections and prevent lateral movement or data exfiltration before the threat escalates.

IOC Summary

Threat: botnetdomain Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: botnetdomain
let malicious_domains = dynamic(["jkqhdbbbqwiujkaz.hopto.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["jkqhdbbbqwiujkaz.hopto.org"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the URLhaus: botnetdomain Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Software Update Checks by Endpoint Protection Agents

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender, CrowdStrike Falcon, or SentinelOne) frequently poll specific update servers to check for the latest threat intelligence feeds. These servers often host dynamic content that URLhaus may flag as “botnetdomain” due to high traffic volume and shared IP ranges used by botnets.
  • Filter/Exclusion: Create a filter excluding traffic where the User-Agent string contains known vendor identifiers (e.g., *DefenderSvc*, *CrowdStrikeService*) AND the destination URL domain matches the specific update server domains (e.g., *.microsoft.com, *.crowdstrike.com). Alternatively, exclude alerts originating from hosts tagged with the “Endpoint Protection Server” asset group.

• Scenario: Scheduled Cloud Backup and Synchronization Jobs

  • Context: Automated backup solutions like Veeam, Rubrik, or Microsoft OneDrive for Business perform scheduled synchronization tasks that connect to cloud storage endpoints. These services often utilize Content Delivery Networks (CDNs) with shared infrastructure that URLhaus classifies as botnet-related due to their distributed nature and high connection counts.
  • Filter/Exclusion: Implement an exclusion based on the Source Host being part of a “Backup Infrastructure” AD group or Azure Tag, combined with a time-based filter for known maintenance windows (e.g., excluding alerts generated between 02:00–04:00 local time). Additionally, whitelist specific destination domains associated with the backup vendor (e.g., *.veeam.com, *.rubrik.com).

• Scenario: Internal CI/CD Pipeline Artifact Retrieval