URLhaus: exe Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors distribute executable files through malicious URLs flagged by URLhaus to facilitate initial access or payload delivery. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of malicious .exe links allows for rapid containment before the execution phase triggers broader lateral movement or data exfiltration within the environment.

IOC Summary

Threat: exe Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: exe
let malicious_domains = dynamic(["solar-sanat.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["solar-sanat.net"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: exe Malicious URLs detection rule in an enterprise environment, along with targeted exclusion strategies:

• Scenario: Patch Management Software Updates

  • Context: Enterprise patch management tools like Microsoft WSUS, Ivanti Neurons, or Jamf Pro frequently download executable installers (.exe) from vendor repositories to stage updates before deployment. These downloads often originate from trusted CDN domains that may be flagged by URLhaus due to high traffic volume or generic file signatures.
  • Filter/Exclusion: Create an exclusion rule for the specific source IP ranges of your patch management servers and whitelist known vendor domains (e.g., *.microsoft.com, *.jamf.com, *.ivanti.com) in the detection logic, ensuring the URL path contains keywords like /update or /download.

• Scenario: Scheduled Backup Agent Executables

  • Context: Automated backup solutions such as Veeam, Commvault, or Rubrik run scheduled jobs that trigger their agent executables to connect to cloud storage endpoints. These agents often initiate HTTP/HTTPS requests to download configuration scripts or small utility .exe files from the vendor’s update servers during peak maintenance windows, mimicking a malicious download pattern.
  • Filter/Exclusion: Implement a time-based filter that excludes alerts occurring within defined maintenance windows (e.g., 02:00–04:00 UTC) for hosts tagged with Role=BackupAgent. Additionally, exclude URLs containing the specific backup vendor’s API endpoint paths.

• Scenario: Internal Software Deployment via SCCM/Intune

  • Context: When IT administrators push new software deployments using Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune, client machines download the deployment package executables from internal distribution