URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where endpoints download files from URLs flagged by URLhaus as containing active malware downloads. Proactive hunting is essential in Azure Sentinel to rapidly isolate compromised hosts and prevent lateral movement before the downloaded payloads execute or spread across the network.

IOC Summary

Threat: malware_download Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["115.55.218.131", "182.113.193.242", "14.0.131.161"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.55.218.131", "182.113.193.242", "14.0.131.161"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: malware_download detection rule in an enterprise environment, along with recommended filters or exclusions:

• Automated Security Tool Updates: Endpoint protection agents (e.g., CrowdStrike Falcon Defender, Microsoft Defender for Endpoint) frequently download definition updates and threat intelligence feeds from vendor cloud repositories. These downloads often originate from high-volume IP ranges that URLhaus may flag as malware_download due to the nature of the payload, even though they are benign.

  • Filter/Exclusion: Create a filter excluding traffic where the destination domain matches known vendor update domains (e.g., *.crowdstrike.com, *.microsoft.com) or specific IP ranges associated with the security tool’s update servers.

• Scheduled Software Deployment via Configuration Management: System administrators often use tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible to push software patches and new applications. These jobs trigger bulk downloads of installers from internal artifact repositories or public CDNs, which can be misidentified as malicious downloads by the URLhaus engine.

  • Filter/Exclusion: Exclude events where the user account is a service account (e.g., svc-deployment) or the process name matches known deployment tools (e.g., ccmexec.exe, ansible-runner), specifically during scheduled maintenance windows.

• Cloud Backup and Synchronization Services: Enterprise users running background synchronization for cloud storage (e.g., OneDrive, Google Drive, Dropbox) often download large files that contain executable components or compressed archives. URLhaus may flag these as potential malware downloads because the file signatures resemble known malicious patterns found in public datasets.

  • Filter/Exclusion: Implement an exclusion based on the source process name (e.g., OneDrive.exe, GoogleBackupAndSync) and filter out URLs containing specific cloud storage path identifiers (e.g., `/file/download