URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior involving the download of files from newly identified malicious URLs flagged by URLhaus as containing malware, which often indicates early-stage lateral movement or initial access attempts. A SOC team should proactively hunt for this activity in Azure Sentinel to rapidly identify and isolate compromised endpoints before the downloaded malware executes and establishes persistence within the environment.

IOC Summary

Threat: malware_download Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["192.109.139.74"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.109.139.74"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: malware_download” Rule

• Scenario: Automated Software Deployment via Configuration Management Tools

  • Context: Enterprise deployment tools like Microsoft SCCM, Ansible, or Chef frequently pull installer packages (.msi, .exe) from public vendor repositories or internal artifact servers that host a high volume of new binaries. These tools often download files to temporary cache directories before distribution, triggering the malware_download tag due to the nature of the file type and source URL reputation.
  • Suggested Filter: Exclude traffic originating from known deployment server IP ranges (e.g., 10.20.30.0/24) or filter URLs containing specific vendor domains (e.g., *.microsoft.com, *.oracle.com) when the user agent string matches the deployment tool (e.g., SCCM-Agent or Ansible-Runner).

• Scenario: Scheduled Security Scanner Updates

  • Context: Endpoint protection suites such as CrowdStrike Falcon, SentinelOne, or McAfee execute scheduled jobs to download definition updates, threat intelligence feeds, and engine patches from their cloud repositories. These downloads often occur during off-hours and involve large binary files that URLhaus may initially flag as potential malware due to the dynamic nature of update URLs.
  • Suggested Filter: Create an exclusion for specific recurring URLs associated with the security vendor’s update servers (e.g., *.falcon.crowdstrike.com) or apply a time-based filter to suppress alerts generated during known maintenance windows (e.g., 02:00–04:00 UTC) when these scheduled jobs run.

• Scenario: Legitimate Cloud Backup and Archive Downloads

  • Context: Data protection solutions like Veeam, Rubrik, or Acronis