URLhaus: exe Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where threat actors distribute executable malware through malicious URLs flagged by URLhaus, indicating potential drive-by downloads or phishing campaigns targeting end-user systems. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the executables establish persistence on the network.

IOC Summary

Threat: exe Total URLs: 2 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: exe
let malicious_domains = dynamic(["85.120.255.252", "tue-orange-01.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["85.120.255.252", "tue-orange-01.cfd"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: exe Malicious URLs rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Software Updates via Cloud Repositories

  • Context: Automated patching tools like Microsoft Update, WSUS (Windows Server Update Services), or third-party agents such as Ivanti Neurons frequently download executable installers (.exe) from trusted cloud endpoints. These URLs often contain dynamic parameters that may be flagged by URLhaus heuristics despite being benign.
  • Filter/Exclusion: Create a whitelist exclusion for known update domains (e.g., *.microsoft.com, *.update.microsoft.com, *.ivanti.com). Additionally, filter out alerts where the source process is specifically Usoclient.exe or IvantiAgent.exe.

• Scenario: Admin Deployment of Enterprise Applications

  • Context: System administrators using Microsoft Endpoint Configuration Manager (MECM/SCCM) or Intune often trigger mass deployments by pulling .exe packages from internal distribution points or external vendor portals. The URL signature for these downloads can mimic malicious patterns due to the nature of large executable transfers.
  • Filter/Exclusion: Exclude alerts originating from internal IP ranges (e.g., 10.x.x.x, 192.168.x.x) where the initiating process is ccmsetup.exe or IntuneManagementExtension.exe.

• Scenario: CI/CD Pipeline Artifact Retrieval

  • Context: In DevOps environments, build agents (e.g., Jenkins, Azure DevOps, GitLab Runner) frequently download executable artifacts from artifact repositories like Nexus Repository Manager or Artifactory. These downloads often occur during nightly builds and involve .exe files that are