URLhaus: connectwise Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity where endpoints establish connections to malicious URLs identified by URLhaus and associated with ConnectWise, potentially indicating compromised remote support sessions or supply chain attacks. The SOC team should proactively investigate these detections in Azure Sentinel to validate legitimate traffic versus active threats that could lead to data exfiltration or lateral movement within the network.

IOC Summary

Threat: connectwise Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: connectwise
let malicious_domains = dynamic(["www.dropbox.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["www.dropbox.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the URLhaus: connectwise Malicious URLs detection rule:

• Scenario: Automated Patch Deployment via ConnectWise Control

  • Context: The IT Operations team schedules a nightly job using ConnectWise Control (formerly Datto) to push OS updates and security patches to remote endpoints. This process triggers outbound connections to connectwise.com or specific subdomains like update.connectwise.com to download patch manifests, which the URLhaus feed may flag as “malicious” due to high-volume traffic patterns resembling data exfiltration.
  • Suggested Filter: Exclude URLs containing the path /api/v1/updates or originating from the internal IP range of the Patch Management Server (e.g., 10.20.5.15) when the destination domain is connectwise.com.

• Scenario: Admin Dashboard Access for Helpdesk Ticketing

  • Context: Service Desk analysts access the ConnectWise Manage portal daily to update ticket statuses and attach large files (logs, screenshots) via the web interface. The browser session generates multiple requests to manage.connectwise.com for asset synchronization, which can be misidentified as a malicious URL interaction if the specific subdomain isn’t whitelisted in the threat intelligence feed.
  • Suggested Filter: Create an exclusion rule for user agents containing Chrome/Enterprise or Edge/Corporate accessing the domain manage.connectwise.com, specifically filtering out traffic where the HTTP method is POST and the payload size exceeds 5MB (indicating file uploads rather than suspicious downloads).

• Scenario: Third-Party Integration Webhooks

  • Context: The enterprise CRM system (Salesforce) or ERP (Microsoft Dynamics 365) utilizes webhooks to sync customer data with ConnectWise. These automated background