URLhaus: jar Malicious URLs

Hunt Hypothesis

Adversaries may leverage malicious URLs tagged as “jar” to deliver Java Archive payloads or establish command-and-control channels, often exploiting the ubiquity of Java in enterprise environments. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or network traffic attempting to interact with known malicious infrastructure before the payload executes or data exfiltration occurs.

IOC Summary

Threat: jar Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: jar
let malicious_domains = dynamic(["www.minecraft-cheats.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["www.minecraft-cheats.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Java Application Health Checks: Internal monitoring agents (e.g., Datadog, New Relic, or custom PowerShell scripts) may poll specific endpoints on legacy Java-based internal services (such as Jenkins, SonarQube, or custom microservices) to verify service availability. If these internal services are hosted on IP ranges or domains that have been historically associated with Jar malware campaigns in the URLhaus feed, the health check requests could trigger the detection.

  • Filter/Exclusion: Exclude source IPs belonging to the Monitoring-Team or Service-Accounts AD group, or exclude specific internal hostnames (e.g., *.internal.corp) from the URL match if the URL is known to be an internal service endpoint.

• CI/CD Pipeline Artifact Downloads: Continuous Integration/Continuous Deployment (CI/CD) systems like Jenkins, GitLab CI, or Azure DevOps often download build artifacts, dependencies, or container images from internal artifact repositories (e.g., Nexus, Artifactory, or AWS S3). If a temporary bucket or repository path matches a URL pattern seen in the Jar malware feed (e.g., a specific path like /api/v1/download or a specific query string), legitimate build jobs could be flagged.

  • Filter/Exclusion: Exclude processes named java.exe or mvn (Maven) when the parent process is jenkins.exe, gitlab-runner.exe, or azure-devops-agent.exe, or exclude URLs containing specific internal artifact repository domains (e.g., nexus.corp.com, artifactory.corp.com).

• Java-based Scheduled Backup Jobs: Enterprise backup solutions (e.g., Veeam, Commvault, or custom Java-based backup scripts) often use Java executables to connect to backup repositories or transfer data. If the backup repository URL or API endpoint coincidentally matches a malicious Jar URL