URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversaries leveraging known malicious URLs to distribute malware downloads, a tactic often used in initial access or supply chain compromise scenarios. Proactively hunting for these indicators within Azure Sentinel is critical to intercept early-stage infections before they propagate across endpoints and exfiltrate sensitive data.

IOC Summary

Threat: malware_download Total URLs: 4 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["112.247.84.112", "60.18.11.118"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.247.84.112", "60.18.11.118"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: malware_download detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Antivirus Definition Updates via Cloud Repositories

  • Scenario: Endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection automatically download the latest malware definition signatures from their respective cloud update servers. These downloads often contain executable payloads that URLhaus flags as potential “malware_download” due to the nature of the file type and source reputation.
  • Suggested Filter/Exclusion: Create an exclusion rule based on known benign FQDNs (e.g., *.crowdstrike.com, *.microsoft.com, updates.symantec.com) or exclude traffic originating from specific Service Accounts used by these AV agents (e.g., svc-crowdstrike-updater).

• Scheduled Software Patching and Deployment Jobs

  • Scenario: Automated deployment tools such as Microsoft System Center Configuration Manager (SCCM), Ivanti Neurons, or PDQ Deploy execute nightly scheduled jobs to push software patches, installers (.exe/.msi), or runtime libraries to workstations. These downloads often trigger the rule because they involve downloading executable files from internal distribution points that may not yet be fully whitelisted in external threat intelligence feeds.
  • Suggested Filter/Exclusion: Exclude traffic where the source IP belongs to the enterprise’s internal Patch Management Server subnet (e.g., 10.20.50.x) or filter out URLs containing specific deployment signatures like /packages/ or /deployments/.

• CI/CD Pipeline Artifact Retrieval

  • Scenario: During build and release cycles, DevOps platforms like Jenkins, GitLab CI, or Azure DevOps