URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis detects adversaries leveraging known malicious URLs to distribute malware downloads, a tactic often used in initial access or command and control phases. Proactively hunting for these specific URLhaus-tagged indicators within Azure Sentinel is critical to intercept early-stage infections before they propagate across the enterprise network.

IOC Summary

Threat: malware_download Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["115.48.146.85"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.48.146.85"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: malware_download detection rule, including targeted filters and exclusions:

• Enterprise Antivirus Definition Updates: Scheduled daily update tasks from major security vendors often fetch large definition files from trusted domains that URLhaus may flag due to high traffic volume or new hash signatures.
  • Filter/Exclusion: Exclude URLs containing specific vendor domains (e.g., *.microsoft.com, *.kaspersky-labs.com, *.crowdstrike.com) and restrict the rule to trigger only if the destination port is not 443 (HTTPS) or if the file extension is .cab or .exe known for updates.
• Automated Patch Management Deployments: Tools like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti often download patches from public repositories where the URL structure matches generic malware patterns, triggering alerts during nightly maintenance windows.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 01:00–05:00 local time) for host groups tagged as “Patch Server” or “Update Agent,” and whitelist specific URL paths containing /updates or /patches.
• Cloud Backup and Synchronization Services: Background processes from tools like Veeam, Rubrik, or OneDrive/SharePoint sync clients frequently download large metadata files or backup chunks that can be misidentified as malicious downloads due to their size and frequency.
  • Filter/Exclusion: Exclude traffic originating from service accounts (e.g., svc_backup, sync_agent) and whitelist URLs containing cloud storage provider domains such as *.sharepoint.com, *.veeam.com, or *.rubrik.com.
• Developer Build Pipelines and CI/CD Runs: Internal Jenkins, GitLab, or Azure DevOps agents regularly pull dependencies (NuGet, Maven, npm) from