URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversaries leveraging compromised or newly registered domains to distribute malware downloads via six specific malicious URLs flagged by URLhaus. Proactive hunting in Azure Sentinel is critical to rapidly isolate affected endpoints and prevent lateral movement before these malicious payloads execute within the network.

IOC Summary

Threat: malware_download Total URLs: 6 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["123.14.85.100", "88.84.222.217"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.14.85.100", "88.84.222.217"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: malware_download detection rule, including tailored filters and exclusions:

• Antivirus Endpoint Definition Updates

  • Scenario: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) automatically query vendor update servers to download new signature definitions. These downloads often originate from high-volume domains that URLhaus may flag as “malware_download” due to the sheer volume of executable payloads being transferred.
  • Filter/Exclusion: Create an exclusion rule based on specific destination IP ranges or hostnames associated with the AV vendor (e.g., *.microsoft.com, *.crowdstrike.com) and filter by process name (e.g., MsMpEng.exe or csfalcon.exe).

• Scheduled Software Patching Jobs

  • Scenario: Automated patch management tools like SCCM (Microsoft Endpoint Configuration Manager) or Ivanti run nightly scheduled jobs to download installer packages (.msi, .exe) from public repositories. These large downloads of legitimate software updates can mimic the behavior of a user downloading a malicious executable.
  • Filter/Exclusion: Exclude traffic where the source process is identified as the patching agent (e.g., ccmexec.exe, IvantiAgent.exe) and the URL contains known repository paths (e.g., /updates/, /packages/).

• Cloud Backup Agent Data Sync

  • Scenario: Cloud backup agents (such as Veeam, Rubrik, or Acronis) periodically download metadata snapshots or small delta files from cloud storage gateways. The URLhaus engine may interpret these binary data transfers as potential malware downloads if the gateway domain has a mixed reputation score.
  • Filter/Exclusion: Implement an exclusion for traffic where the destination port is specific to the backup service (e.g., 8