URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversaries leveraging known malicious URLs from the URLhaus database to initiate malware downloads and subsequent execution on endpoints. Proactive hunting for this behavior in Azure Sentinel is critical to rapidly isolate compromised assets before lateral movement occurs, given the high severity of these initial infection vectors.

IOC Summary

Threat: malware_download Total URLs: 9 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["pub-da43c68507c44a0f89782831aed83484.r2.dev", "110.37.68.65"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["pub-da43c68507c44a0f89782831aed83484.r2.dev", "110.37.68.65"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Tool Updates via Trusted Vendors

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or SIEM agents automatically download definition updates or binary patches from their respective vendor update servers. URLhaus often flags these high-volume download URLs as “suspicious” due to the sheer volume of traffic and dynamic subdomains used by vendors.
  • Suggested Filter/Exclusion: Create an allowlist exclusion for known vendor domains (e.g., *.crowdstrike.com, *.microsoftonline.com) or specific update endpoints. Additionally, filter out alerts where the destination port is 443 and the user agent string explicitly contains the security tool’s name (e.g., FalconSensor or DefenderSvc).

• Scenario: Scheduled RPA Bots Executing Data Ingestion Jobs

  • Context: Robotic Process Automation (RPA) tools like UiPath or Microsoft Power Automate run scheduled jobs to fetch raw data files from external partner portals. These bots often download CSV, JSON, or XML payloads from URLs that may have recently been added to URLhaus’ “newly observed” list, triggering a false positive before the URL is fully whitelisted globally.
  • Suggested Filter/Exclusion: Exclude alerts originating from specific service accounts (e.g., svc-rpa-bot-01) or IP ranges dedicated to RPA infrastructure. Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC) when these heavy download jobs typically execute.

• **Scenario: Admin Deployment of Internal Software Packages via SCCM/