URLhaus: IRAHook Malicious URLs

Hunt Hypothesis

This hypothesis targets adversary activity where malicious URLs associated with the IRAHook malware family are accessed to establish command-and-control channels or facilitate data exfiltration. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints and interrupt the malware’s persistence and payload execution before significant data is stolen.

IOC Summary

Threat: IRAHook Total URLs: 3 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: IRAHook
let malicious_domains = dynamic(["www.dropbox.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["www.dropbox.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Whitelisting: Older enterprise applications (e.g., specific versions of SAP, Oracle, or custom internal tools) may hardcode C2 endpoints or update servers that coincidentally match known IRAHook domains due to shared infrastructure or compromised third-party CDNs.
  • Filter: Exclude URLs where the User-Agent string matches the specific legacy application identifier (e.g., SAP-Logon/7.50) or where the source process is a known signed binary from that vendor (e.g., saplogon.exe).
• Scheduled Patch/Update Jobs: System administrators often use PowerShell or batch scripts to pull configuration files or patches from internal or external repositories. If a patch server domain was recently flagged by URLhaus due to a transient compromise or misclassification, legitimate Invoke-WebRequest or curl calls will trigger the alert.
  • Filter: Exclude alerts where the initiating process is powershell.exe or cmd.exe and the command line contains specific keywords like -Patch, -Update, or -Config, or where the source IP is within the corporate internal range (e.g., 10.0.0.0/8).
• Developer Testing Environments: Developers frequently test API integrations or web services against staging environments that might use domains listed in URLhaus for load testing or if they share a DNS zone with a compromised production domain.
  • Filter: Exclude alerts originating from hosts tagged with the AD group DEV-TESTING or where the source process is a development IDE (e.g., code.exe, idea64.exe, pycharm64.exe).
• Browser Extension Auto-Updates: Some enterprise-approved browser extensions (e.g., for SSO or monitoring) may auto-update by contacting a CDN domain that has been added to the URLhaus list due to a supply chain issue or shared hosting provider