URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints download files from known malicious URLs flagged by URLhaus as active malware distribution channels. A SOC team should proactively hunt for this activity in Azure Sentinel to rapidly isolate compromised systems and prevent lateral movement before the downloaded payloads execute or exfiltrate sensitive data.

IOC Summary

Threat: malware_download Total URLs: 16 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["110.37.19.50", "123.10.39.137", "83.228.109.209", "27.37.101.114", "182.126.244.31", "182.127.104.245", "202.107.5.110", "182.113.24.161", "182.126.93.53", "42.224.101.181", "119.118.72.174", "175.148.152.124", "123.14.81.148", "42.176.248.147"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["110.37.19.50", "123.10.39.137", "83.228.109.209", "27.37.101.114", "182.126.244.31", "182.127.104.245", "202.107.5.110", "182.113.24.161", "182.126.93.53", "42.224.101.181", "119.118.72.174", "175.148.152.124", "123.14.81.148", "42.176.248.147"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download Malicious URLs rule, including targeted filters and exclusions:

• Scenario: Automated Patch Management Scans

  • Context: Enterprise patch management tools like Microsoft WSUS, Ivanti Neurons, or Jamf Pro frequently query public repositories to check for the latest security definitions or update manifests. These queries often hit URLs that URLhaus has recently flagged as “suspicious” due to transient behavior, even though they are trusted sources within the organization’s whitelist.
  • Suggested Filter: Exclude traffic originating from specific application IDs (e.g., WSUS, Ivanti) or filter by destination domain suffixes known to be internal update servers (e.g., *.update.microsoft.com, *.jamfsoftware.com).

• Scenario: Scheduled Antivirus Definition Refresh

  • Context: Endpoint Protection platforms such as CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection run scheduled jobs every 4–6 hours to download the latest threat intelligence feeds. These downloads often utilize generic or shared CDN endpoints that may have a high volume of traffic, causing URLhaus to occasionally tag them as “malware_download” due to heuristic anomalies in file signatures rather than actual compromise.
  • Suggested Filter: Create an exclusion rule for source IP ranges belonging to the Endpoint Management servers and filter by specific User-Agent strings containing keywords like CrowdStrike, SentinelOne, or Symantec.

• Scenario: Cloud Backup Agent Connectivity Checks

  • Context: Cloud backup solutions like Veeam, Rubrik, or Acronis Cyber Protect perform periodic connectivity checks and metadata synchronization with their SaaS backends. These agents often download small configuration files or manifests from public URLs that URLhaus