URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints initiate downloads from known malicious URLs identified by URLhaus as sources of active malware distribution. Proactively hunting for these specific download events in Azure Sentinel is critical to rapidly identify and contain potential initial infection vectors before they escalate into widespread compromise across the organization’s cloud infrastructure.

IOC Summary

Threat: malware_download Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["112.248.191.227", "123.188.214.188"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.248.191.227", "123.188.214.188"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are four specific false positive scenarios for the URLhaus: malware_download rule in an enterprise environment, along with targeted exclusion strategies:

• Endpoint Management Software Updates

  • Scenario: The organization utilizes Microsoft Intune or Jamf Pro to push critical security patches and software updates. These tools frequently download executable installers (.msi, .exe) from the vendor’s CDN, which may be flagged as malware_download by URLhaus due to the high volume of new binaries being distributed globally before they are fully indexed by threat intelligence feeds.
  • Suggested Filter: Create an exclusion rule for traffic originating from known internal management servers (e.g., *.manage.microsoft.com, *.jamfcloud.com) or specific destination IP ranges associated with the software vendor’s update channels, provided the user agent string contains the device management tool name.

• Automated Backup and Disaster Recovery Jobs

  • Scenario: Scheduled nightly jobs using Veeam Backup & Replication or Commvault initiate large data transfers to cloud storage providers (e.g., AWS S3, Azure Blob). During these windows, the backup agents download configuration manifests or software components from public URLs that may be misidentified as malicious downloads due to their generic naming conventions and high entropy.
  • Suggested Filter: Exclude traffic occurring during defined maintenance windows (e.g., 02:00–06:00 UTC) where the source host is a dedicated backup server role, or filter specifically for destination URLs ending in .backup.com or specific S3 bucket paths used by the enterprise.

• Third-Party API Integration and Data Ingestion

  • Scenario: The IT operations team runs custom Python scripts using Ansible or PowerShell to ingest data from external financial or HR APIs (e.g., Workday,