URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging known malicious URLs to distribute malware downloads that may evade standard static signature detection by utilizing newly identified threat intelligence feeds. Proactively hunting for these specific URLhaus-tagged indicators in Azure Sentinel allows the SOC team to identify early-stage infection vectors and mitigate potential lateral movement before widespread compromise occurs.

IOC Summary

Threat: malware_download Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["77.236.74.65"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["77.236.74.65"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download rule, including targeted filters and exclusions:

• Automated Software Update Agents: Enterprise endpoints running background update services often trigger this rule when downloading patches or new versions. For instance, Microsoft System Center Configuration Manager (SCCM) or WSUS clients frequently fetch installer packages from Microsoft’s CDN URLs (go.microsoft.com, update.microsoft.com) which may be flagged as “malware_download” due to high volume and dynamic content signatures.

  • Suggested Filter: Exclude traffic originating from known update service accounts (e.g., NT SERVICE\WUAuserv or specific SCCM client processes) accessing Microsoft’s official CDN domains (*.microsoft.com, *.windowsupdate.com).

• Cloud Backup and Synchronization Tools: Managed file synchronization tools like Microsoft OneDrive for Business or Google Workspace Drive often generate download events when users sync large files or restore versions. These tools frequently utilize dynamic URLs that URLhaus might classify as suspicious due to the nature of file transfer protocols, even though the content is benign corporate data.

  • Suggested Filter: Create an exclusion for traffic where the User-Agent string contains “OneDrive” or “Google Drive”, and the destination domain matches the organization’s specific tenant URLs (e.g., *.sharepoint.com, *.googleusercontent.com).

• Scheduled Antivirus Definition Updates: The endpoint protection suite itself, such as CrowdStrike Falcon or SentinelOne, runs scheduled jobs to download the latest threat intelligence feeds and definition updates. These downloads often hit external repositories that URLhaus tags as “malware_download” because they involve downloading executable signature files from security vendors’ public endpoints.

  • Suggested Filter: Exclude alerts generated by the specific process names of the AV agents (e.g., falcon.sys, `Sentinel