This hypothesis targets adversaries who leverage known malicious download URLs to fetch payloads or establish initial footholds, often bypassing traditional signature-based defenses. Proactively hunting for these specific URLhaus entries in Azure Sentinel allows the SOC to identify compromised endpoints or web traffic anomalies that may have slipped past real-time detection, enabling rapid containment before lateral movement occurs.
Threat: malware_download Total URLs: 32 Active URLs: 27
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://112.248.247.253:50048/bin.sh | online | malware_download | 2026-09-18 |
hxxp://175.175.71.204:60282/i | offline | malware_download | 2026-09-18 |
hxxp://221.15.15.87:41114/bin.sh | offline | malware_download | 2026-09-18 |
hxxp://42.55.7.232:55832/i | online | malware_download | 2026-09-18 |
hxxp://42.179.154.108:52470/i | online | malware_download | 2026-09-18 |
hxxp://59.97.250.69:33684/bin.sh | offline | malware_download | 2026-09-18 |
hxxp://175.175.63.177:56180/bin.sh | online | malware_download | 2026-09-18 |
hxxp://175.166.115.209:55257/bin.sh | online | malware_download | 2026-09-18 |
hxxp://95.54.82.154:29012/i | online | malware_download | 2026-09-18 |
hxxp://180.110.39.190:3588/bin.sh | online | malware_download | 2026-09-18 |
hxxp://175.174.100.13:42309/bin.sh | online | malware_download | 2026-09-18 |
hxxp://178.206.102.22:49024/i | online | malware_download | 2026-09-18 |
hxxp://42.6.60.216:53925/i | online | malware_download | 2026-09-18 |
hxxp://182.126.117.243:52960/bin.sh | online | malware_download | 2026-09-18 |
hxxp://221.15.15.87:41114/i | offline | malware_download | 2026-09-18 |
hxxp://175.174.100.13:42309/i | online | malware_download | 2026-09-18 |
hxxp://175.166.115.209:55257/i | online | malware_download | 2026-09-18 |
hxxp://175.175.63.177:56180/i | online | malware_download | 2026-09-18 |
hxxp://27.37.101.170:52175/i | online | malware_download | 2026-09-18 |
hxxp://175.147.225.150:37066/i | online | malware_download | 2026-09-18 |
hxxp://175.147.225.150:37066/bin.sh | online | malware_download | 2026-09-18 |
hxxp://27.44.145.153:53273/i | online | malware_download | 2026-09-18 |
hxxp://163.142.93.214:42447/i | online | malware_download | 2026-09-18 |
hxxp://175.148.2.195:45066/bin.sh | online | malware_download | 2026-09-18 |
hxxp://175.173.130.151:57947/i | online | malware_download | 2026-09-18 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["182.126.117.243", "175.147.225.150", "175.146.154.144", "27.44.145.153", "95.54.82.154", "42.6.60.216", "175.166.115.209", "175.175.63.177", "180.110.39.190", "60.21.175.220", "175.173.130.151", "175.165.81.227", "175.174.100.13", "42.177.186.47", "27.37.101.170", "163.142.93.214", "178.206.102.22", "42.179.154.108", "112.248.247.253", "175.148.2.195", "42.55.7.232"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.117.243", "175.147.225.150", "175.146.154.144", "27.44.145.153", "95.54.82.154", "42.6.60.216", "175.166.115.209", "175.175.63.177", "180.110.39.190", "60.21.175.220", "175.173.130.151", "175.165.81.227", "175.174.100.13", "42.177.186.47", "27.37.101.170", "163.142.93.214", "178.206.102.22", "42.179.154.108", "112.248.247.253", "175.148.2.195", "42.55.7.232"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
curl or wget to download a specific build artifact, container image, or dependency package from a URL that was previously flagged by URLhaus due to a transient compromise or a shared CDN endpoint (e.g., a public S3 bucket or GitHub release link) that was later cleaned up.
.internal, .corp) or specific trusted cloud storage endpoints (e.g., s3.amazonaws.com, blob.core.windows.net) if the download originates from an authorized service account or CI/CD pipeline identity.download.microsoft.com, support.apple.com, or a specific vendor’s CDN) that has a known URLhaus entry due to a historical issue or a generic path match (e.g., /download/latest.exe).
*.microsoft.com/download/*, *.apple.com/support/*) and exclude these from the hunt if the user belongs to the IT-Admins or Patch-Management security group.svc-telemetry, svc-backup) or processes with specific names (e.g., logshipper.exe, backupagent.exe) if the URL matches a predefined