URLhaus: .jar malware Malicious URLs

Hunt Hypothesis

This hunt targets the execution of malicious Java Archive (.jar) files delivered via known bad URLs, a common initial access vector for deploying cross-platform payloads that often bypass standard web filters. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or users interacting with these specific threats before they establish persistence or lateral movement within the environment.

IOC Summary

Threat: .jar malware Total URLs: 5 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: .jar malware
let malicious_domains = dynamic(["skymoders.top", "opsecmod.st", "prestigeclient.st"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["skymoders.top", "opsecmod.st", "prestigeclient.st"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Java Web Application Deployment (WAR/JAR Extraction)

  • Scenario: DevOps engineers or application owners deploy updated microservices or Java libraries using tools like curl or wget to download .jar artifacts from internal artifact repositories (e.g., Nexus, Artifactory) or public CDNs (e.g., Maven Central, JFrog). If the URLhaus rule matches specific hash-based or path-based URLs that overlap with legitimate artifact paths, this triggers false positives during standard CI/CD pipeline executions or manual hotfix deployments.
  • Filter/Exclusion: Exclude traffic where the source IP is within the internal CI/CD subnet range (e.g., 10.20.0.0/24) AND the destination port is 443 AND the User-Agent contains Jenkins, GitLab-Runner, or Maven. Alternatively, exclude specific known-good artifact repository domains (e.g., nexus.internal.corp.com, repo1.maven.org) if the rule is URL-specific rather than hash-based.

• Java Development IDE Auto-Update or Dependency Resolution

  • Scenario: Developers using IDEs like IntelliJ IDEA, Eclipse, or VS Code with Java extensions automatically check for plugin updates or resolve missing dependencies by fetching .jar files from configured remote repositories. If a developer’s machine connects to a public repository URL that coincidentally matches one of the 5 malicious URLs in the hunt package (due to similar path structures or CDN sharing), the rule fires during routine development work.
  • Filter/Exclusion: Exclude processes where the parent process name is java.exe, javaw.exe, or IDE executables (idea64.exe, eclipse.exe, Code.exe) AND the destination domain is a known public Maven/Gradle repository (e.g., repo1.maven.org, plugins.gradle.org).