URLhaus: droppper Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors utilize known dropper URLs to deliver initial payloads that establish a foothold within the network. A proactive hunt in Azure Sentinel is essential because these droppers often serve as the first stage of multi-stage attacks, enabling early intervention before lateral movement or data exfiltration occurs.

IOC Summary

Threat: droppper Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: droppper
let malicious_domains = dynamic(["pub-5eee967508114192a40c0ca052a3bb9d.r2.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-5eee967508114192a40c0ca052a3bb9d.r2.dev"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Dropper Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Software Update Scanners

  • Context: Enterprise endpoint management tools like Microsoft Intune, Jamf Pro, or SolarWinds Patch Manager frequently initiate background connections to vendor update servers (e.g., update.microsoft.com, cdn.jamfsoftware.com) to download patches. These URLs often host executable payloads that URLhaus may classify as “droppers” due to their behavior of downloading and staging installers, triggering a false alert on the endpoint’s network traffic.
  • Suggested Filter/Exclusion: Create an exclusion rule based on Process Name (e.g., Microsoft.Intune.Agent.exe, JamfProAgent) combined with Destination Domain Reputation. Exclude any URL where the destination domain is in a trusted internal allow-list or has a “Verified” status in the organization’s DNS Security layer.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated backup solutions such as Veeam, Rubrik, or Commvault run scheduled jobs to transfer data to cloud repositories (e.g., AWS S3, Azure Blob). The initial connection often involves downloading a small configuration script or agent updater from the cloud provider’s edge nodes. URLhaus may flag these generic download endpoints as droppers because they serve executable components required for the backup session initialization.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window aligned with known maintenance windows (e.g., 02:00–04:00 UTC). Additionally, filter out alerts where the Source Process is identified as a known backup service (e.g., Veeam.Backup.Service.exe) and the URL Category