URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection rule identifies adversaries leveraging known malicious URLs to distribute malware downloads, a tactic often used in initial access or command and control phases of an attack chain. Proactively hunting for these specific URLhaus-tagged indicators within Azure Sentinel is critical to intercept potential infections early, preventing lateral movement and data exfiltration before they compromise the broader network environment.

IOC Summary

Threat: malware_download Total URLs: 7 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["chrome-windows.ru", "103.193.173.199", "chrome-desktop.net", "110.36.30.184"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["chrome-windows.ru", "103.193.173.199", "chrome-desktop.net", "110.36.30.184"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: malware_download Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Tool Updates

  • Context: Endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black frequently download definition updates, threat intelligence feeds, or patch manifests from vendor-specific domains that may be flagged by URLhaus as “malware_download” due to high traffic volume or new domain age.
  • Filter/Exclusion: Create a rule exclusion based on the Source Host being part of the Security-Tools AD Group and the Destination Domain matching known vendor domains (e.g., *.crowdstrike.com, *.microsoftonline.net). Alternatively, filter out events where the User Agent string contains specific identifiers like “CrowdStrike Falcon Sensor” or “DefenderUpdate”.

• Scenario: Scheduled Backup and Migration Jobs

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or Commvault often run nightly scheduled jobs that download large metadata files, configuration snapshots, or incremental backups from cloud storage gateways. These downloads can mimic the behavior of a malicious file transfer if the destination URL is dynamic or hosted on a shared CDN.
  • Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the Process Name matches backup executables (vbr.exe, rubrik-agent.exe) and the Destination Port is standard for HTTPS (443). Additionally, whitelist specific IP ranges associated with the organization’s cloud storage provider.

• Scenario: Software Deployment via Configuration Management

  • Context: IT administrators utilize tools like Microsoft SCCM (ConfigMgr), **Ans