URLhaus: exe Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are likely malicious executable files used by adversaries to deliver payloads and compromise endpoints. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential command and control or data exfiltration activities early.

IOC Summary

Threat: exe Total URLs: 10 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: exe
let malicious_domains = dynamic(["github.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["github.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is downloading a legitimate .exe file from a trusted source (e.g., Microsoft Update) as part of a routine patch deployment.
  Filter/Exclusion: Exclude URLs containing update.microsoft.com or windowsupdate.microsoft.com in the URL field.

• Scenario: A scheduled job is running a legitimate software update tool (e.g., Chocolatey or WSUS) that downloads .exe files from internal repositories.
  Filter/Exclusion: Exclude URLs containing internal-repo.company.com or chocolatey in the URL field.

• Scenario: A user is accessing a legitimate .exe file hosted on a company’s internal file server (e.g., \\fileserver\shared\tools\setup.exe) via a mapped network drive.
  Filter/Exclusion: Exclude URLs containing fileserver or \\fileserver in the URL field, or filter by internal IP ranges.

• Scenario: A security tool (e.g., CrowdStrike Falcon, Microsoft Defender ATP) is performing a scheduled scan and temporarily downloads a .exe file for signature analysis.
  Filter/Exclusion: Exclude URLs containing crowdstrike.com, microsoft.com, or defenderatp.microsoft.com in the URL field.

• Scenario: A developer is using a CI/CD pipeline (e.g., Jenkins, GitHub Actions) to deploy a build artifact that includes a .exe file as part of a legitimate application release.
  Filter/Exclusion: Exclude URLs containing jenkins, github.com, or ci-cd.pipeline in the URL field.