URLhaus: IRAHook Malicious URLs

Hunt Hypothesis

This hunt targets the execution of known malicious URLs associated with the IRAHook malware family, which adversaries may leverage to deploy payloads or establish initial footholds in the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic patterns before the malware can propagate or exfiltrate data, reducing the mean time to detection for this high-severity threat.

IOC Summary

Threat: IRAHook Total URLs: 12 Active URLs: 0

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: IRAHook
let malicious_domains = dynamic(["www.dropbox.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["www.dropbox.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A security team or incident response (IR) engineer manually opens a known malicious URL in a browser to verify the payload, check headers, or capture network traffic for forensics. This is often done in a controlled environment or with specific browser extensions that log requests.

  • Filter/Exclusion: Exclude events where the source user account belongs to a dedicated SecurityOps or IRTeam security group, or filter out traffic where the destination IP is a known internal analysis proxy (e.g., 10.20.30.40) that intercepts and logs the request before it hits the internet.

• Scenario: An automated vulnerability scanner or web application security tool (such as Nessus, Qualys, or Acunetix) performs active scanning and probes known malicious endpoints to verify if the asset is still vulnerable or to map the attack surface. These tools frequently hit URLhaus-listed domains during their “active scan” phase.

  • Filter/Exclusion: Exclude traffic originating from specific scanner service accounts (e.g., svc-nessus, svc-qualys) or from known IP ranges designated for scanning appliances. Additionally, filter out events where the User-Agent string contains identifiable scanner signatures (e.g., Nessus, Qualys, Acunetix).

• Scenario: A developer or DevOps engineer is testing a new URL shortening service, a content delivery network (CDN) configuration, or a redirect chain in a staging environment. They may intentionally use a URL listed on URLhaus as a test case to ensure their logging, blocking, or redirect logic works correctly.

  • Filter/Exclusion: Exclude traffic where the source host is part of the Staging or Dev environment subnet (e.g., 172.16.0.0/16), or filter out