URLhaus: exe Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors distribute executable files via malicious URLs to initiate command-and-control communication or deliver initial payloads within the Azure Sentinel environment. The SOC team should proactively hunt for these specific URL patterns to rapidly isolate compromised endpoints and prevent lateral movement before the execution of potentially harmful .exe files spreads across the network.

IOC Summary

Threat: exe Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: exe
let malicious_domains = dynamic(["aethersyncmatrix5.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["aethersyncmatrix5.lol"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: exe Malicious URLs rule, including tailored filters and exclusions:

• Scenario: Automated Patching via Microsoft Update Services

  • Context: The Windows Update service (wuauserv) or WSUS client regularly downloads executable installers (.exe patches) from go.microsoft.com, download.windowsupdate.com, or software.download.prss.microsoft.com. These legitimate URLs often match the “malicious exe” signature due to high traffic volume and dynamic content.
  • Filter/Exclusion: Create an exclusion rule for the destination domain *.microsoft.com and *.windowsupdate.com when the source process is svchost.exe (specifically the wuauserv service) or MicrosoftUpdate.exe.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise Endpoint Protection tools like CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection run scheduled jobs to fetch the latest definition signatures and engine updates. These downloads frequently originate from vendor-specific CDN URLs hosting .exe payloads that may be flagged by URLhaus heuristics.
  • Filter/Exclusion: Exclude traffic where the user agent string contains specific vendor identifiers (e.g., CrowdStrike, SentinelOne) or filter by destination domains such as *.crowdstrike.com, *.sentinelone.net, and *.symantec.com.

• Scenario: Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune pushes application updates to endpoints. The distribution points often serve .exe installers from internal file servers or Azure Blob Storage URLs that are tagged as executable downloads, triggering the rule despite being trusted internal traffic.

  ---