URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries who leverage known malicious URLs to download and execute payloads, a common initial access or execution technique that often bypasses traditional signature-based defenses. Proactively hunting for these specific URLhaus entries in Azure Sentinel allows the SOC to identify compromised endpoints or network traffic patterns before the malware fully establishes persistence or begins lateral movement.

IOC Summary

Threat: malware_download Total URLs: 16 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["78.25.123.5", "175.150.71.167", "188.59.39.97", "112.93.137.192", "60.23.235.89", "113.231.116.128", "120.84.214.95"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["78.25.123.5", "175.150.71.167", "188.59.39.97", "112.93.137.192", "60.23.235.89", "113.231.116.128", "120.84.214.95"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps team uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to fetch a specific build artifact or dependency from a staging repository that has been temporarily indexed by URLhaus due to a shared IP or a recent, benign release.

  • Filter/Exclusion: Exclude network connections where the source process is a known CI/CD agent (e.g., agent.exe, jenkins-agent.jar) or where the destination URL matches a specific internal staging domain (e.g., *.staging.internal.corp) and the user agent string identifies the pipeline tool.

• Scenario: A security team performs a “canary token” or honeypot test by deploying a known benign script or binary to a test VM, which is then accessed by a monitoring agent or a scheduled integrity check job, causing the URL to be flagged if it was previously seen in a different context or if the URLhaus tag is stale.

  • Filter/Exclusion: Exclude events where the source host is tagged as TestVM or Honeypot in CMDB, or where the initiating process is a known monitoring agent (e.g., data_collector.exe, logstash) and the destination port is 80/443 with a valid internal certificate.

• Scenario: An enterprise application (e.g., a legacy Java-based ERP system) dynamically loads a plugin or configuration file from a vendor’s public CDN. If the vendor’s CDN URL is shared across multiple products and one product had a past vulnerability, the URL may be tagged as malware_download even if the specific file being fetched is benign.

  • Filter/Exclusion: Allowlist specific vendor CDN domains (e.g., cdn.vendor.com) for processes associated with the ERP application (e.g., java.exe with a specific command line argument), or exclude if