URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where endpoints download known malware from a curated set of twelve malicious URLs flagged by URLhaus. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before the downloaded payloads execute.

IOC Summary

Threat: malware_download Total URLs: 12 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["108.181.197.32", "tangentwaves.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["108.181.197.32", "tangentwaves.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the URLhaus: malware_download Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Software Update Agents

  • Context: Enterprise deployment tools like Microsoft System Center Configuration Manager (SCCM) or Intune frequently download update packages, drivers, and patches from vendor repositories. These downloads often originate from URLs that URLhaus may flag as “malware_download” due to the high volume of traffic or shared hosting infrastructure used by vendors.
  • Suggested Filter/Exclusion: Create an exclusion rule for source processes matching ccmsetup.exe, IntuneManagementExtension.exe, and wsappx where the destination URL contains known vendor domains (e.g., *.microsoft.com, *.update.microsoft.com).

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled jobs every 4-6 hours to fetch the latest threat intelligence signatures. These background services initiate HTTPS connections to update servers that may be tagged by URLhaus due to their dynamic nature and high download frequency.
  • Suggested Filter/Exclusion: Exclude network traffic initiated by specific service processes (e.g., C:\Program Files\CrowdStrike\fsqa.exe, C:\Windows\System32\DefenderSvc) connecting to the vendor’s update endpoints, provided the user context is “SYSTEM” or a dedicated service account.

• Scenario: Enterprise Content Delivery & Knowledge Base Access

  • Context: Users accessing internal knowledge bases (e.g., Confluence, SharePoint) or external content delivery networks (CDNs) like Akamai or Cloudflare often trigger downloads of large assets, whitepapers