URLhaus: fake-software Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where attackers distribute deceptive software packages via malicious URLs to trick users into downloading and executing compromised applications. A SOC team should proactively hunt for these indicators in Azure Sentinel because fake software campaigns often serve as a primary entry point for supply chain attacks that can lead to widespread credential theft or ransomware deployment across the organization.

IOC Summary

Threat: fake-software Total URLs: 8 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: fake-software
let malicious_domains = dynamic(["github.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["github.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: fake-software Malicious URLs rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Software Deployment via Microsoft Endpoint Configuration Manager (SCCM/MECM)

  • Scenario: The SCCM site server or distribution points frequently initiate outbound connections to vendor update repositories (e.g., download.adobe.com, update.microsoft.com) that host installer packages. URLhaus may flag these dynamic download links as “fake-software” because they resemble the structure of phishing URLs mimicking legitimate software updates.
  • Filter/Exclusion: Create a whitelist exclusion for traffic originating from SCCM Distribution Point IP addresses or specific FQDNs (e.g., *.configmgr.com) connecting to known vendor update domains, specifically filtering out HTTP POST requests containing user-agent strings like “Microsoft Endpoint Configuration Manager”.

• Automated Browser Update Checks by Corporate Kiosk Systems

  • Scenario: Enterprise kiosk terminals or shared workstations running scheduled tasks (via Windows Task Scheduler) to check for browser updates (e.g., Chrome, Edge). These jobs often query update.google.com or go.microsoft.com using generic URLs that lack specific version parameters, triggering the “fake-software” tag due to high entropy in the URL path.
  • Filter/Exclusion: Exclude alerts where the source process is a known browser executable (e.g., chrome.exe, msedge.exe) running under the context of a scheduled task named “BrowserUpdateCheck”, and restrict the scope to specific kiosk subnet ranges (e.g., 10.50.x.x).

• DevOps Pipeline Artifact Retrieval by CI/CD Agents

  • Scenario: Jenkins or Azure DevOps agents pull build artifacts from internal artifact repositories (like Nexus or Artifactory) that proxy external dependencies. When