URLhaus: Loader Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where threat actors utilize known malicious loader URLs to establish initial footholds and deliver secondary payloads within the network. Proactively hunting for these specific URL patterns in Azure Sentinel is critical to intercept early-stage infection vectors before they escalate into broader compromise scenarios involving data exfiltration or lateral movement.

IOC Summary

Threat: Loader Total URLs: 43 Active URLs: 0

URL	Status	Threat	Date Added
`hxxp://blabhunk-copy.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://seendone-clef.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://willbile-gyms.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://richoverfold.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://dovepact-gist.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://getrichcurl.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://weak-obeylore.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://pollsort-tick.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://ternlaiddram.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://babyglee-all.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://give-pore-upon.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://root-slot-quit.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://her-vein-pool.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://duel-gulp-luck.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://markherdbark.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://bold-blab-cold.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://nice-aunt-milk.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://nearzero-drug.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://oryx-foryell.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://drug-arereef.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://dumb-heel-boy.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://this-maimreef.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://shaggulf-sold.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://wind-cragblur.xyz/avast_update`	offline	malware_download	2026-07-23
`hxxp://gain-daze-kept.xyz/avast_update`	offline	malware_download	2026-07-23

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Loader
let malicious_domains = dynamic(["getrichcurl.xyz", "babyglee-all.xyz", "markherdbark.xyz", "this-maimreef.xyz", "her-vein-pool.xyz", "oryx-foryell.xyz", "rideloreomit.xyz", "and-last-lock.xyz", "pollsort-tick.xyz", "seendone-clef.xyz", "willbile-gyms.xyz", "ternlaiddram.xyz", "drug-arereef.xyz", "tire-moat-shin.xyz", "dumb-heel-boy.xyz", "nice-aunt-milk.xyz", "give-pore-upon.xyz", "gain-daze-kept.xyz", "wind-cragblur.xyz", "bold-blab-cold.xyz", "blabhunk-copy.xyz", "weak-obeylore.xyz", "richoverfold.xyz", "dovepact-gist.xyz", "tang-sail-and.xyz", "kiltwent-our.xyz", "shaggulf-sold.xyz", "root-slot-quit.xyz", "nearzero-drug.xyz", "duel-gulp-luck.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["getrichcurl.xyz", "babyglee-all.xyz", "markherdbark.xyz", "this-maimreef.xyz", "her-vein-pool.xyz", "oryx-foryell.xyz", "rideloreomit.xyz", "and-last-lock.xyz", "pollsort-tick.xyz", "seendone-clef.xyz", "willbile-gyms.xyz", "ternlaiddram.xyz", "drug-arereef.xyz", "tire-moat-shin.xyz", "dumb-heel-boy.xyz", "nice-aunt-milk.xyz", "give-pore-upon.xyz", "gain-daze-kept.xyz", "wind-cragblur.xyz", "bold-blab-cold.xyz", "blabhunk-copy.xyz", "weak-obeylore.xyz", "richoverfold.xyz", "dovepact-gist.xyz", "tang-sail-and.xyz", "kiltwent-our.xyz", "shaggulf-sold.xyz", "root-slot-quit.xyz", "nearzero-drug.xyz", "duel-gulp-luck.xyz"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Loader Malicious URLs detection rule, along with targeted filtering strategies:

Scenario: Automated Software Update Scanners
- Context: Enterprise endpoint management tools like Microsoft Intune, Jamf Pro, or Ivanti Neurons frequently query external update repositories to check for patches. These services often download small “loader” executables (e.g., .msi or .exe wrappers) from cloud storage URLs that may be newly registered and flagged by URLhaus as generic loaders before full reputation is established.
- Filter/Exclusion: Create an exclusion rule based on the Source Process Name (IntuneAgent.exe, JamfProService.exe) AND Destination Domain (e.g., *.microsoft.com, *.jamfcloud.com). Exclude traffic where the URL path contains /update or /download.
Scenario: Scheduled Backup and Migration Jobs
- Context: Automated backup solutions such as Veeam, Rubrik, or Acronis Cyber Protect run nightly jobs that initiate data transfer sessions. These tools often utilize a “loader” component to stage files before the main transfer begins, connecting to cloud storage endpoints (e.g., AWS S3, Azure Blob) via URLs that URLhaus may classify as generic loaders due to high volume and dynamic IP usage.
- Filter/Exclusion: Filter out alerts occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the Source Host belongs to the “Backup-Server” AD Group and the User Agent string contains Veeam or Rubrik.
Scenario: CI/CD Pipeline Artifact Downloads
- Context: DevOps platforms like **J